CVE-2019-3950

Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to.

Score

CVSS 3.0 9.8 Critical

Status

Modified - vulnreport@tenable.com

Published

2019-07-09

Last modified

2024-08-04

Weaknesses

CWE-798

Affected products

• Basestation Firmware (Arlo)
• Vmb3010 Firmware (Arlo)
• Vmb3500 Firmware (Arlo)
• Vmb4000 Firmware (Arlo)
• Vmb4500 Firmware (Arlo)
• Vmb5000 Firmware (Arlo)

References

• https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechan…