CVE Vulnerability

CVE-2019-10886

An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.9 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2019/Apr/32 Mailing List Third Party Advisory
http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html VDB Entry Third Party Advisory
https://www.sony.com/electronics/support/downloads/00016043 Exploit Vendor Advisory
https://seclists.org/bugtraq/2019/Apr/34 Mailing List Exploit
http://www.securityfocus.com/bid/108072 Third Party Advisory VDB Entry
Configurations

Configuration 1
Information

Published : 2019-04-19 06:29

Updated : 2020-08-24 05:37

NVD link : CVE-2019-10886

Mitre link : CVE-2019-10886

Products Affected

Sony

Xbr-85x857d

CWE
CWE-306