CVE-2019-16651

An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them).

• CWE-863

• https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/Exploit, Third Party Advisory
• https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-in-virgin-media-routersThird Party Advisory
• https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/Exploit, Third Party Advisory
• https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-in-virgin-media-routersThird Party Advisory

Published

Sep 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16644App\Home\Controller\ZhuantiController.class.php in TuziCMS 2…9.8
• CVE-2019-16645An issue was discovered in Embedthis GoAhead 2.5.0. Certain …8.6
• CVE-2019-16647Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for W…7.2
• CVE-2019-16649On Supermicro H11, H12, M11, X9, X10, and X11 products, a co…10
• CVE-2019-1665A vulnerability in the web-based management interface of Cis…4.7
• CVE-2019-16650On Supermicro X10 and X11 products, a client's access privil…10
• CVE-2019-16652The BPM component in Genius Bytes Genius Server (Genius CDDS…7.2
• CVE-2019-16653An application plugin in Genius Bytes Genius Server (Genius …8.8
• CVE-2019-16655joyplus-cms 1.6.0 allows reinstallation if the install/ URI …7.5
• CVE-2019-16656joyplus-cms 1.6.0 allows remote attackers to execute arbitra…9.8
• CVE-2019-16657TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as d…6.1
• CVE-2019-16658TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.8.8