CVE-2019-3988 describes a critical command injection vulnerability in the Blink XT2 Sync Module firmware prior to version 2.13.11. This flaw allows remote attackers on the same local network to execute arbitrary commands by sending specially crafted input to the bssid parameter during Wi-Fi configuration. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk, enabling full compromise of the device with high confidentiality, integrity, and availability impacts, requiring only adjacent network access and no user interaction. While no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available and it is not listed on the KEV catalog, the vulnerability has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.13.11CPE matchmatch criteria | cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Blink XT2 Sync Module Multiple Vulnerabilities
Dec 5, 2019Blink XT2 Sync Module Multiple Vulnerabilities
Dec 5, 2019Blink XT2 Sync Module Multiple Vulnerabilities
Dec 5, 2019Blink XT2 Sync Module Multiple Vulnerabilities
Dec 5, 2019Blink XT2 Sync Module Multiple Vulnerabilities
Dec 5, 2019