{"id":"CVE-2019-12477","aliases":["EUVD-2019-4073","GHSA-gh58-hv6c-gx26"],"status":"published","title":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a...","description":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri\u0026uri= URI.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.13318,"percentile":0.96427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2019-06-07T14:51:07Z","modified":"2026-06-17T02:14:44Z","exploits":[{"source":"exploitdb","id":"EDB-46971","title":"Supra Smart Cloud TV - 'openLiveURL()' Remote File Inclusion","type":"webapps","platform":"hardware","date":"2019-06-06","url":"https://www.exploit-db.com/exploits/46971"},{"source":"metasploit","id":"auxiliary/admin/http/supra_smart_cloud_tv_rfi","title":"Supra Smart Cloud TV Remote File Inclusion","type":"auxiliary","date":"2019-06-03","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/supra_smart_cloud_tv_rfi"}],"products":[{"vendor":"supra","product":"stv-lc40lt0020f_firmware"}],"references":[{"url":"https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12477"},{"url":"https://github.com/advisories/GHSA-gh58-hv6c-gx26"}],"sources":{"cve":[{"id":"CVE-2019-12477","description":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri\u0026uri= URI.","status":"published","published":"2019-06-07T14:51:07Z","modified":"2024-08-04T23:24:38.483Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4073","description":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri\u0026uri= URI.","status":"published","published":"2019-06-07T14:51:07Z","modified":"2024-08-04T23:24:38Z","updated_at":"2026-11-03T02:40:45.973526Z"}],"ghsa":[{"id":"GHSA-gh58-hv6c-gx26","title":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a...","description":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri\u0026uri= URI.","status":"published","published":"2022-05-24T16:47:36Z","modified":"2024-04-04T00:54:20Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:55:53.307931Z"}],"nvd":[{"id":"CVE-2019-12477","description":"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri\u0026uri= URI.","status":"published","published":"2019-06-07T15:29:01.48Z","modified":"2026-06-17T02:14:44.35Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:16.285679Z"}]}}