CVE-2019-19494

Katalog CVE

CVSS 8.8 · High EPSS 23,1%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada sagemcom f@st 3890 firmware, sagemcom f@st 3686 firmware +5 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.

Rincian

Terbit di NVD

9 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

23,1% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cablehaunt.com exploit · deskripsi teknis · advisory pihak ketiga
• https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf deskripsi teknis · advisory pihak ketiga
• https://github.com/Lyrebirds/Fast8690-exploit exploit · advisory pihak ketiga
• https://www.broadcom.com product