Vulnerabilities

TI-2023-05803 CVE-2023-6320 · GHSA-wm52-4cc3-xxgg

Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

MEDIUM 48

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.03952 Published 2024-04-09 No fix listed CWE-78

TI-2023-05802 CVE-2023-6319 · GHSA-rgwx-4v25-2mj5

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

MEDIUM 51

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.06437 Published 2024-04-09 No fix listed CWE-78

TI-2023-05801 CVE-2023-6318 · GHSA-m5v4-f2gf-v6x5

Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

MEDIUM 49

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.04667 Published 2024-04-09 No fix listed CWE-78

TI-2023-05800 CVE-2023-6317 · GHSA-rm4x-93m8-4qcv

PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

MEDIUM 44

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01087 Published 2024-04-09 No fix listed CWE-639

Vulnerabilities

Filters

Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction