{"cvss":0.0,"datePublished":"2019-06-13T00:00:00Z","dateUpdated":"2019-06-13T00:00:00Z","description":"The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.","dueDate":"","id":"CVE-2019-12780","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"crock-pot_smart_slow_cooker_with_wemo_firmware","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"belkin crock-pot_smart_slow_cooker_with_wemo_firmware Improper Neutralization of Special Elements used in an OS Command","vendor":"belkin"}