Vulnerabilities > CVE-2018-15723 - Unspecified vulnerability in Logitech Harmony HUB Firmware

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

logitech

critical

NVD

Published: 2018-12-20

Updated: 2019-10-09

Summary

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).

Vulnerable Configurations

Part	Description	Count
OS	Logitech Logitech Harmony HUB Firmware 4.9.40 Logitech Harmony HUB Firmware 4.10.30 Logitech Harmony HUB Firmware 4.11.6 Logitech Harmony HUB Firmware 4.12.36 Logitech Harmony HUB Firmware 4.13.100 Logitech Harmony HUB Firmware 4.14.110 Logitech Harmony HUB Firmware 4.14.123 Logitech Harmony HUB Firmware 4.15.96 Logitech Harmony HUB Firmware 4.15.105 Logitech Harmony HUB Firmware 4.15.119 Logitech Harmony HUB Firmware 4.15.193 Logitech Harmony HUB Firmware 4.15.201	12
Hardware	Logitech Logitech Harmony HUB -	1

References

https://www.tenable.com/security/research/tra-2018-47