CVE-2019-13129

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 8080. It is caused by snprintf and inappropriate length handling.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/morouter_stackoverflow.pdfExploit, Third Party Advisory
https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/morouter_stackoverflow.pdfExploit, Third Party Advisory

Timeline

Published: Jul 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13136.5An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka CVE-2019-131319.8Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRP CVE-2019-131329.8In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq applicati CVE-2019-131335.5ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.CVE-2019-131345.5ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.CVE-2019-131358.8ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.CVE-2019-131367.8ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.CVE-2019-131376.5ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.CVE-2019-131398.4In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be abl CVE-2019-13146.8A security feature bypass vulnerability exists in Windows 10 Mobile when Cortana allows a user to access files and folders through the locke CVE-2019-131406.5Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DE CVE-2019-131425.5The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable