Vulnerability Description
An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Virginmedia | Super Hub 3 Firmware | - |
| Virginmedia | Super Hub 3 | - |
Related Weaknesses (CWE)
References
- https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cvExploitThird Party Advisory
- https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-Third Party Advisory
- https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cvExploitThird Party Advisory
- https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-Third Party Advisory
FAQ
What is CVE-2019-16651?
CVE-2019-16651 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebin...
How severe is CVE-2019-16651?
CVE-2019-16651 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-16651?
Check the references section above for vendor advisories and patch information. Affected products include: Virginmedia Super Hub 3 Firmware, Virginmedia Super Hub 3.