CVE-2019-9119

An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteSettings API function, as demonstrated by shell metacharacters in the staticroute_list field.

• CWE-78

• https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetStaticRouteSettings.mdExploit, Third Party Advisory
• https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetStaticRouteSettings.mdExploit, Third Party Advisory

Published

Mar 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9113Ming (aka libming) 0.4.8 has a NULL pointer dereference in t…
• CVE-2019-9114Ming (aka libming) 0.4.8 has an out of bounds write vulnerab…
• CVE-2019-9115In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.j…
• CVE-2019-9116DLL hijacking is possible in Sublime Text 3 version 3.1.1 bu…
• CVE-2019-9117An issue was discovered on Motorola C1 and M2 devices with f…
• CVE-2019-9118An issue was discovered on Motorola C1 and M2 devices with f…
• CVE-2019-9120An issue was discovered on Motorola C1 and M2 devices with f…
• CVE-2019-9121An issue was discovered on Motorola C1 and M2 devices with f…
• CVE-2019-9122An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…8.8
• CVE-2019-9123An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…9.8
• CVE-2019-9124An issue was discovered on D-Link DIR-878 1.12B01 devices. A…
• CVE-2019-9125An issue was discovered on D-Link DIR-878 1.12B01 devices. B…