CVE-2019-11319

CRITICAL

Motorola CX2 and M2 1.01 - Remote Code Execution via hnap downloadFirmware JSON Value

Title source: llm
STIX 2.1

Description

An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code execution via shell metacharacters in a JSON value.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf

Scores

CVSS v3 9.8
EPSS 0.0391
EPSS Percentile 89.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
motorola/cx2_firmware 1.01
motorola/m2_firmware 1.01
Published Apr 18, 2019
Tracked Since Feb 18, 2026