CVE-2019-15310

CVE-2019-15310 is a critical remote code execution vulnerability affecting various devices utilizing Linkplay firmware. It allows an unauthenticated attacker to gain full control over Linkplay's AWS infrastructure by retrieving AWS keys from the firmware. This, combined with an OS command injection flaw in the firmware update process, enables code execution on affected devices, which typically have automatic updates enabled. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The potential impact includes unauthorized access to sensitive data, system manipulation, and widespread device compromise. Despite its critical severity, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are also minimal, suggesting a lack of widespread public awareness or attention.