CVE-2019-12780 (crock-pot_smart_slow_cooker_with_wemo_firmware)

The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.

View Full Alert