8.1

CVE-2019-11336

Exploit
Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sony ≫ Photo Sharing Plus Version < pkg6.5629
   Sony ≫ Kdl-50w800c Version -
   Sony ≫ Kdl-50w805c Version -
   Sony ≫ Kdl-50w807c Version -
   Sony ≫ Kdl-50w809c Version -
   Sony ≫ Kdl-50w820c Version -
   Sony ≫ Kdl-55w800c Version -
   Sony ≫ Kdl-55w805c Version -
   Sony ≫ Kdl-65w850c Version -
   Sony ≫ Kdl-65w855c Version -
   Sony ≫ Kdl-65w857c Version -
   Sony ≫ Kdl-75w850c Version -
   Sony ≫ Kdl-75w855c Version -
   Sony ≫ X7500d Version -
   Sony ≫ Xbr-100z9d Version -
   Sony ≫ Xbr-43x800d Version -
   Sony ≫ Xbr-43x800e Version -
   Sony ≫ Xbr-43x830c Version -
   Sony ≫ Xbr-49x700d Version -
   Sony ≫ Xbr-49x800c Version -
   Sony ≫ Xbr-49x800d Version -
   Sony ≫ Xbr-49x800e Version -
   Sony ≫ Xbr-49x830c Version -
   Sony ≫ Xbr-49x835c Version -
   Sony ≫ Xbr-49x835d Version -
   Sony ≫ Xbr-49x837c Version -
   Sony ≫ Xbr-49x839c Version -
   Sony ≫ Xbr-49x900e Version -
   Sony ≫ Xbr-55a1e Version -
   Sony ≫ Xbr-55x700d Version -
   Sony ≫ Xbr-55x800e Version -
   Sony ≫ Xbr-55x805c Version -
   Sony ≫ Xbr-55x806e Version -
   Sony ≫ Xbr-55x807c Version -
   Sony ≫ Xbr-55x809c Version -
   Sony ≫ Xbr-55x810c Version -
   Sony ≫ Xbr-55x850c Version -
   Sony ≫ Xbr-55x850d Version -
   Sony ≫ Xbr-55x855c Version -
   Sony ≫ Xbr-55x855d Version -
   Sony ≫ Xbr-55x857c Version -
   Sony ≫ Xbr-55x857d Version -
   Sony ≫ Xbr-55x900c Version -
   Sony ≫ Xbr-55x900e Version -
   Sony ≫ Xbr-55x905c Version -
   Sony ≫ Xbr-55x907c Version -
   Sony ≫ Xbr-55x930d Version -
   Sony ≫ Xbr-55x930e Version -
   Sony ≫ Xbr-65a1e Version -
   Sony ≫ Xbr-65x750d Version -
   Sony ≫ Xbr-65x800c Version -
   Sony ≫ Xbr-65x805c Version -
   Sony ≫ Xbr-65x807c Version -
   Sony ≫ Xbr-65x809c Version -
   Sony ≫ Xbr-65x810c Version -
   Sony ≫ Xbr-65x850c Version -
   Sony ≫ Xbr-65x850d Version -
   Sony ≫ Xbr-65x850e Version -
   Sony ≫ Xbr-65x855c Version -
   Sony ≫ Xbr-65x855d Version -
   Sony ≫ Xbr-65x857c Version -
   Sony ≫ Xbr-65x857d Version -
   Sony ≫ Xbr-65x900c Version -
   Sony ≫ Xbr-65x900e Version -
   Sony ≫ Xbr-65x905c Version -
   Sony ≫ Xbr-65x907c Version -
   Sony ≫ Xbr-65x930c Version -
   Sony ≫ Xbr-65x930d Version -
   Sony ≫ Xbr-65x930e Version -
   Sony ≫ Xbr-65x935d Version -
   Sony ≫ Xbr-65x937d Version -
   Sony ≫ Xbr-65z9d Version -
   Sony ≫ Xbr-75x850c Version -
   Sony ≫ Xbr-75x850d Version -
   Sony ≫ Xbr-75x850e Version -
   Sony ≫ Xbr-75x855c Version -
   Sony ≫ Xbr-75x855d Version -
   Sony ≫ Xbr-75x857d Version -
   Sony ≫ Xbr-75x900e Version -
   Sony ≫ Xbr-75x910c Version -
   Sony ≫ Xbr-75x940c Version -
   Sony ≫ Xbr-75x940d Version -
   Sony ≫ Xbr-75x940e Version -
   Sony ≫ Xbr-75x945c Version -
   Sony ≫ Xbr-75z9d Version -
   Sony ≫ Xbr-77a1e Version -
   Sony ≫ Xbr-85x850d Version -
   Sony ≫ Xbr-85x855d Version -
   Sony ≫ Xbr-85x857d Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.21% 0.865
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/32
Third Party Advisory
Exploit
Mailing List
http://www.securityfocus.com/bid/108072
Third Party Advisory
VDB Entry
https://seclists.org/bugtraq/2019/Apr/34
Third Party Advisory
Exploit
Mailing List
https://www.darkmatter.ae/xen1thlabs/sony-smart-tv-photo-sharing-plus-information-disclosure-vulnerability-xl-19-003/
Third Party Advisory
Exploit