CVE-2018-7539

PoC —

CVSS 3.0

9.8 critical

EPSS

4%p90

Published

Apr 17, 2018 (Apr 17, 2018)

Modified

Jun 17, 2026

Description

On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.

Vendors: appeartv
Products: xc5000 firmware, xc5100 firmware
Weakness: CWE-22
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.2%)

In the news0 stories

No ingested article mentions this CVE yet.