// For flags

CVE-2018-15723

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).

Logitech Harmony Hub, en versiones anteriores a la 4.15.206, es vulnerable a una inyección de comandos a nivel de aplicación mediante una petición HTTP manipulada. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad para ejecutar comandos definidos por la aplicación (por ejemplo, harmony.system?systeminfo).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-08-22 CVE Reserved
  • 2018-12-20 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-346: Origin Validation Error
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Logitech
Search vendor "Logitech"
Harmony Hub Firmware
Search vendor "Logitech" for product "Harmony Hub Firmware"
< 4.15.206
Search vendor "Logitech" for product "Harmony Hub Firmware" and version " < 4.15.206"
-
Affected
in Logitech
Search vendor "Logitech"
Harmony Hub
Search vendor "Logitech" for product "Harmony Hub"
--
Safe