CVE-2019-15513

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-667

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155145.3The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is No CVE-2019-155156.5Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155167.5Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-155175.5jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.CVE-2019-155185.3Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.CVE-2019-155199.8Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.CVE-2019-15523.3OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in T CVE-2019-155205.3comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.CVE-2019-155219.8Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing a CVE-2019-155229.8An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when t CVE-2019-155235.3An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of th CVE-2019-155249.8CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads t