CVE-2018-14839criticalunder attackCWE-78

CVE-2018-14839

Published · Updated

Follow this CVE+ Monitor N1A1 NAS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 89%
from disclosure to weapon
Published on NVDMay 14
CISA KEV+1046d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

An LG NAS device running firmware 3718.510 allows attackers to run arbitrary code remotely by sending specially crafted HTTP POST requests. This is critical because it gives complete control of the device to anyone with network access.

Technical detail

CWE-78 command injection vulnerability in LG N1A1 NAS 3718.510 accessible via HTTP POST parameters without proper input validation or sanitization. Unauthenticated remote attackers can execute arbitrary system commands, achieving full device compromise with no user interaction required.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a