CVE-2019-3702

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://atomic111.github.io/article/lifesize-icon-remote-code-executionExploit, Third Party Advisory
https://www.lifesize.com/en/video-conferencing-camerasProduct, Vendor Advisory
https://www.sva.de/solutions/it-security.htmlNot Applicable
https://atomic111.github.io/article/lifesize-icon-remote-code-executionExploit, Third Party Advisory
https://www.lifesize.com/en/video-conferencing-camerasProduct, Vendor Advisory
https://www.sva.de/solutions/it-security.htmlNot Applicable

Timeline

Published: May 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-37047.8VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate CVE-2019-37059.8Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.2 CVE-2019-37069.8Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote CVE-2019-37079.8Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this CVE-2019-37089.6IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an a CVE-2019-37099.6IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can tric CVE-2019-37108.1Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumen CVE-2019-37117.2RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console CVE-2019-37128.8Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflo CVE-2019-37155.5RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in CVE-2019-37167.8RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in pla CVE-2019-37176.8Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical acc