Vulnerability Description
Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arlo | Vmb3010 Firmware | < 1.12.2.3_2762 |
| Arlo | Vmb3010 | - |
| Arlo | Vmb4000 Firmware | < 1.12.2.3_2762 |
| Arlo | Vmb4000 | - |
| Arlo | Vmb3500 Firmware | < 1.12.2.4_2773 |
| Arlo | Vmb3500 | - |
| Arlo | Vmb4500 Firmware | < 1.12.2.4_2773 |
| Arlo | Vmb4500 | - |
| Arlo | Vmb5000 Firmware | < 1.12.2.2_2824 |
| Arlo | Vmb5000 | - |
Related Weaknesses (CWE)
References
- https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-Vendor Advisory
- https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-Vendor Advisory
FAQ
What is CVE-2019-3950?
CVE-2019-3950 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to.
How severe is CVE-2019-3950?
CVE-2019-3950 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-3950?
Check the references section above for vendor advisories and patch information. Affected products include: Arlo Vmb3010 Firmware, Arlo Vmb3010, Arlo Vmb4000 Firmware, Arlo Vmb4000, Arlo Vmb3500 Firmware.