critical9.8
CVE-2019-16340
Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
Impact
Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linksys | Velop Whw0303 Firmware | Version 1.1.8.192419 |
| Linksys | Velop Whw0302 Firmware | Version 1.1.8.192419 |
| Linksys | Velop Whw0301 Firmware | Version 1.1.8.192419 |
Weakness classification
References
- NVD record
- CVE.org record
- http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt
- https://puzzor.github.io/Linksys-Velop-Authentication-bypass
- https://www.linksys.com/us/support-article?articleNum=207568
- http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt
- https://puzzor.github.io/Linksys-Velop-Authentication-bypass
- https://www.linksys.com/us/support-article?articleNum=207568