CVE-2018-15723

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-346

Description

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).

Affected products

Logitech Harmony Hub: before 4.15.206 — fixed in 4.15.206

How to fix

Upgrade to a fixed version: Logitech Harmony Hub 4.15.206. Check the vendor advisory for mitigations.

References

https://www.tenable.com/security/research/tra-2018-47
https://www.tenable.com/security/research/tra-2018-47

Get alerted when CVE-2018-15723 or the next vulnerability affects your stack