Vulnerability in Actiontec T2200h
CVE-2019-12789
An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system board, an attacker can use a special key sequence (Ctrl-\) to obtain a shell with root privileges. After gaining root access, the attacker can mount the filesystem read-write and make permanent modifications to the device including bricking of the device, disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on the device.
EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Actiontec T2200h
- Actiontec T2200h_firmware — versions t2200h-31.1238l.08
- N/a — versions n/a
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, Mailing List, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-12789?
- CVE-2019-12789 is a medium-severity vulnerability in Actiontec T2200h. CVSS score: 6.8/10. Published 2019-06-17.
- How severe is CVE-2019-12789?
- Medium severity. CVSS v3 base score is 6.8 out of 10.