CVE-2019-10886
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware...
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
- Record
CVE-2019-10886- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
- Record
CVE-2019-10886- Updated
- 2026-11-02
EUVDEUVD-2019-2608 No score
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
- Record
EUVD-2019-2608- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q283-2q5f-76fc
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware...
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
- Record
GHSA-q283-2q5f-76fc- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10886 is a medium vulnerability (CVSS 5.9) in Sony Photo Sharing Plus, published April 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. No source names a fixed version.
References
seclists.org/fulldisclosure/2019/Apr/32
packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html
sony.com/electronics/support/downloads/00016043
securityfocus.com/bid/108072
nvd.nist.gov/vuln/detail/CVE-2019-10886
github.com/advisories/GHSA-q283-2q5f-76fc