Vulnerability Description
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roku | Roku Firmware | - |
| Roku | Roku | - |
Related Weaknesses (CWE)
References
- https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet
- https://support.roku.com/article/12554388937879
- https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerabilityPress/Media CoverageThird Party Advisory
- https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet
- https://support.roku.com/article/12554388937879
- https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerabilityPress/Media CoverageThird Party Advisory
FAQ
What is CVE-2018-11314?
CVE-2018-11314 is a vulnerability with a CVSS score of 9.6 (CRITICAL). The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be ex...
How severe is CVE-2018-11314?
CVE-2018-11314 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-11314?
Check the references section above for vendor advisories and patch information. Affected products include: Roku Roku Firmware, Roku Roku.