CVE-2019-11336

CVSS V2 Medium 4.3 CVSS V3 High 8.1
Description
Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886.
Overview
  • CVE ID
  • CVE-2019-11336
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2019-05-14T14:29:00
  • Last Modified Date
  • 2019-05-21T11:56:07
Weakness Enumerations
CWE URL
CWE-532 http://cwe.mitre.org/data/definitions/532.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:sony:photo_sharing_plus:*:*:*:*:*:*:*:* 1 OR pkg6.5629
cpe:2.3:h:sony:kdl-50w800c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-50w805c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-50w807c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-50w809c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-50w820c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-55w800c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-55w805c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-65w850c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-65w855c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-65w857c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-75w850c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:kdl-75w855c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:x7500d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-100z9d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-43x800d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-43x800e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-43x830c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x700d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x800c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x800d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x800e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x830c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x835c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x835d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x837c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x839c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-49x900e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55a1e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x700d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x800e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x805c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x806e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x807c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x809c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x810c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x850c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x850d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x855c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x855d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x857c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x857d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x900c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x900e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x905c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x907c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x930d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-55x930e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65a1e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x750d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x800c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x805c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x807c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x809c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x810c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x850c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x850d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x850e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x855c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x855d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x857c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x857d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x900c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x900e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x905c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x907c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x930c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x930d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x930e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x935d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65x937d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-65z9d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x850c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x850d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x850e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x855c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x855d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x857d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x900e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x910c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x940c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x940d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x940e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75x945c:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-75z9d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-77a1e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-85x850d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-85x855d:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:sony:xbr-85x857d:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.1
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2.2
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://www.darkmatter.ae/xen1thlabs/sony-smart-tv-photo-sharing-plus-information-disclosure-vulnerability-xl-19-003/ Exploit Third Party Advisory
https://seclists.org/bugtraq/2019/Apr/34 Mailing List Exploit Third Party Advisory
http://www.securityfocus.com/bid/108072 Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/32 Mailing List Exploit Third Party Advisory
http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html Exploit Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2019-11336
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11336
History
Created Old Value New Value Data Type Notes
2022-05-10 07:51:57 Added to TrackCVE
2022-12-03 20:38:00 2019-05-14T14:29Z 2019-05-14T14:29:00 CVE Published Date updated
2022-12-03 20:38:00 2019-05-21T11:56:07 CVE Modified Date updated
2022-12-03 20:38:00 Analyzed Vulnerability Status updated