CVE-2019-7404

An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today's_date}.log for reading a filename such as gapm7100_190101.log.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2019-05-13

Last modified

2024-08-04

Weaknesses

CWE-306

Affected products

• Gamp-7100 Firmware (Lg)
• Gapm-7200 Firmware (Lg)
• Gapm-8000 Firmware (Lg)

References

• https://github.com/epistemophilia/CVEs/blob/master/LG-GAMP-Routers/CVE-2019-7404/poc-cve-2019-7404.py