CVE-2019-15304

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-153109.8An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attack CVE-2019-153119.8An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetoot CVE-2019-153128.8An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to b CVE-2019-153136.1In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.CVE-2019-153145.4tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download CVE-2019-153157.8Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the c CVE-2019-153167.0Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via CVE-2019-153175.4The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-153189.8The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-153199.8The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-153209.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-153219.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.