{"resultsPerPage":7,"startIndex":0,"totalResults":7,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-05T02:08:17.299","vulnerabilities":[{"cve":{"id":"CVE-2019-3983","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.150","lastModified":"2026-06-17T02:35:59.727","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protections."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar código arbitrario y comandos en el dispositivo debido a protecciones UART insuficientes."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3985","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.227","lastModified":"2026-06-17T02:35:59.930","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando se establece la configuración wifi del dispositivo por medio del parámetro ssid."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3986","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.320","lastModified":"2026-06-17T02:36:00.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando se establece la configuración wifi del dispositivo por medio del parámetro encryption."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3987","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.400","lastModified":"2026-06-17T02:36:00.133","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando se establece la configuración wifi del dispositivo por medio del parámetro key."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3988","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.477","lastModified":"2026-06-17T02:36:00.233","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando se establece la configuración wifi del dispositivo por medio del parámetro bssid."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3989","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-11T23:15:11.557","lastModified":"2026-06-17T02:36:00.333","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retrieving internal network configuration data."},{"lang":"es","value":"El firmware de Blink XT2 Sync Module versiones anteriores a 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando se recuperan los datos de configuración de la red interna."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"n/a","product":"Amazon's Blink XT2 Sync Module","versions":[{"version":"All firmware versions prior to version 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.11","matchCriteriaId":"FFEE7C5F-CA30-4B2D-A0EE-B7425144489E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-3984","sourceIdentifier":"vulnreport@tenable.com","published":"2019-12-31T18:15:11.610","lastModified":"2026-06-17T02:35:59.833","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet."},{"lang":"es","value":"El módulo de sincronización Blink XT2 versiones del firmware anteriores a la versión 2.13.11, permite a atacantes remotos ejecutar comandos arbitrarios en el dispositivo debido a una entrada saneada inapropiadamente cuando el dispositivo recupera los scripts de actualizaciones de Internet."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"Amazon","product":"Blink XT2 Sync Module firmware","versions":[{"version":"prior to 2.13.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amazon:blink_xt2_sync_module_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.11","matchCriteriaId":"D760A965-7A5F-45DA-A530-3E8979A04F57"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amazon:blink_xt2_sync_module:-:*:*:*:*:*:*:*","matchCriteriaId":"5AFBC607-8887-4CC7-99D0-60D9C8993EE9"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}