CVE-2019-16651

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-166527.2The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.CVE-2019-166538.8An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges.CVE-2019-166557.5joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.CVE-2019-166569.8joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the dat CVE-2019-166576.1TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.CVE-2019-166588.8TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.CVE-2019-166598.8TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.CVE-2019-16665.3A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from th CVE-2019-166608.8joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.CVE-2019-166615.4Ogma CMS 0.5 has XSS via creation of a new blog.CVE-2019-166629.8An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk CVE-2019-166638.8An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php becau