CVE-2019-3950
Critical
Description
Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Arlo Vmb3010 Firmware
PublishedJul 9, 2019
First seenJul 9, 2019
How to fix
Update
- arlo vmb3010_firmware1.12.2.3_2762 or later
- arlo vmb4000_firmware1.12.2.3_2762 or later
- arlo vmb3500_firmware1.12.2.4_2773 or later
- arlo vmb4500_firmware1.12.2.4_2773 or later
- arlo vmb5000_firmware1.12.2.2_2824 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arlo vmb3010_firmware | v < 1.12.2.3_2762 | 1.12.2.3_2762 |
| arlo vmb4000_firmware | v < 1.12.2.3_2762 | 1.12.2.3_2762 |
| arlo vmb3500_firmware | v < 1.12.2.4_2773 | 1.12.2.4_2773 |
| arlo vmb4500_firmware | v < 1.12.2.4_2773 | 1.12.2.4_2773 |
| arlo vmb5000_firmware | v < 1.12.2.2_2824 | 1.12.2.2_2824 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.