CVE-2019-15311

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command execution vulnerabilities.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/Exploit, Third Party Advisory
https://labs.mwrinfosecurity.com/advisories/Third Party Advisory
https://linkplay.com/featured-products/Product
https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/Exploit, Third Party Advisory
https://labs.mwrinfosecurity.com/advisories/Third Party Advisory
https://linkplay.com/featured-products/Product

Timeline

Published: Jul 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-153128.8An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to b CVE-2019-153136.1In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.CVE-2019-153145.4tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download CVE-2019-153157.8Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the c CVE-2019-153167.0Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via CVE-2019-153175.4The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-153189.8The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-153199.8The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-153209.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-153219.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-153229.8The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-153237.5The ad-inserter plugin before 2.4.20 for WordPress has path traversal.