CVE-2018-19524

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. A long password to the Web_passwd function allows remote attackers to cause a denial of service (segmentation fault) or achieve unauthenticated remote code execution because of control of registers S0 through S4 and T4 through T7.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151608/Skyworth-GPON-HomeGateways-Optical-Network-Stack-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Feb/30Exploit, Mailing List, Third Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-001.md
https://seclists.org/bugtraq/2019/Feb/21Exploit, Mailing List, Third Party Advisory
https://www.breakthesec.com/2019/02/cve-2018-19524-stack-overflow-in.html
https://www.exploit-db.com/exploits/46358/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/151608/Skyworth-GPON-HomeGateways-Optical-Network-Stack-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Feb/30Exploit, Mailing List, Third Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-001.md
https://seclists.org/bugtraq/2019/Feb/21Exploit, Mailing List, Third Party Advisory
https://www.breakthesec.com/2019/02/cve-2018-19524-stack-overflow-in.html
https://www.exploit-db.com/exploits/46358/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195256.1An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywo CVE-2018-195276.1i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.CVE-2018-195289.8TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port CVE-2018-195309.8HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely CVE-2018-195319.8HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEnc CVE-2018-195328.8A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creat CVE-2018-195356.5In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a CVE-2018-195377.2TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a con CVE-2018-195396.5An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, lea CVE-2018-195408.8An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18 CVE-2018-195418.8An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18 CVE-2018-195426.5An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading