CVE-2019-11319 is a critical command injection vulnerability affecting Motorola CX2 and M2 devices running firmware version 1.01. This flaw resides in the downloadFirmware function within the hnap service, allowing remote code execution through shell metacharacters in a JSON value. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise potential (confidentiality, integrity, availability). Despite its critical severity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is it listed on the KEV catalog, indicating no known active exploitation. Community discussion and media coverage are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.01CPE matchmatch criteria | cpe:2.3:o:motorola:cx2_firmware:1.01:*:*:*:*:*:*:* | ||
1.01CPE matchmatch criteria | cpe:2.3:o:motorola:m2_firmware:1.01:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.