What’s Vulnerable › Vulnerabilities
CVE-2019-19494
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 23.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-01-09 · updated 2026-06-17
- Weakness: CWE-120
Description
Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.
Affected products
- Compal 7284E Firmware: 5.510.5.11
- Compal 7486E Firmware: 5.510.5.11
- NETGEAR C6250Emr Firmware: 2.01.03, 2.01.05
- NETGEAR Cg3700Emr Firmware: 2.01.03, 2.01.05
- Sagemcom F@St 3686 Firmware: 3.428.0, 4.83.0
- Sagemcom F@St 3890 Firmware: before 50.10.21_t4; before 05.76.6.3f — fixed in 05.76.6.3f, 50.10.21_t4
- Technicolor Tc7230 Steb Firmware: 01.25
How to fix
Upgrade to a fixed version: Sagemcom F@St 3890 Firmware 05.76.6.3f, 50.10.21_t4. Check the vendor advisory for mitigations.
References
- https://cablehaunt.com
- https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
- https://github.com/Lyrebirds/Fast8690-exploit
- https://www.broadcom.com
- https://cablehaunt.com
- https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
- https://github.com/Lyrebirds/Fast8690-exploit
- https://www.broadcom.com
Get alerted when CVE-2019-19494 or the next vulnerability affects your stack