« Volver al listado

CVE-2019-11417

Estado: ModificadaCrítica (9.8)—

system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Trendnet — Tv-ip110wn Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11417",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-04-22T11:29:05.517",
  "references": [
    {
      "url": "https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68."
    },
    {
      "lang": "es",
      "value": "En el archivo system.cgi en las cámaras TRENDnet TV-IP110WN presentan un desbordamiento de búfer generado por una comprobación inadecuada de longitud de fuente anterior a una operación strcpy en la función respondAsp. Los atacantes pueden aprovechar la vulnerabilidad utilizando el parámetro languse con una cadena larga. Esto afecta a la versión 1.2.2 build 28, 64, 65 y 68."
    }
  ],
  "lastModified": "2026-06-17T02:12:53.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D442045-882E-4817-8241-F645E2D3348F"
            },
            {
              "criteria": "cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.64:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "161D56B3-F235-426F-8E4A-3510BA0EED35"
            },
            {
              "criteria": "cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.65:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E98551F5-7A47-4063-9418-A9170DBA8EA1"
            },
            {
              "criteria": "cpe:2.3:o:trendnet:tv-ip110wn_firmware:1.2.2.68:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4EEA19C-8709-4C10-B300-B3356A279C16"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:trendnet:tv-ip110wn:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5353AAB6-C1A0-4425-8CEC-C5EB3E79F05B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}