Vulnerabilities

TI-2018-11211 CVE-2018-15723 · GHSA-g9xw-97cw-m9fh

Origin validation error in Logitech Harmony Hub

MEDIUM 48

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03699 Published 2018-12-20 No fix listed CWE-346

TI-2018-11210 CVE-2018-15722 · GHSA-rx25-3f5x-p54w

LOW 39

The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01643 Published 2018-12-20 No fix listed CWE-78

TI-2018-11209 CVE-2018-15721 · GHSA-wmf8-4j64-vgrw

MEDIUM 46

The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01825 Published 2018-12-20 No fix listed CWE-287

TI-2018-11208 CVE-2018-15720 · GHSA-2m2c-428p-vrf4

MEDIUM 45

Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01495 Published 2018-12-20 No fix listed CWE-798