CVE-2018-20575

HIGH

Orange ARV7519RW22 Livebox 2.1 Firmware - Improper Input Validation in Firmware Update Mechanism

Title source: llm
STIX 2.1

Description

Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/zadewg/LIVEBOX-0DAY

Scores

CVSS v3 7.5
EPSS 0.0098
EPSS Percentile 57.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (1)
orange/arv7519rw22_livebox_2.1_firmware 00.96.320s
Published Dec 28, 2018
Tracked Since Feb 18, 2026