How severe is CVE-2019-12789?

CVE-2019-12789 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-12789 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-12789?

CVE-2019-12789 affects Actiontec T2200h Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-12789?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-12789 published?

CVE-2019-12789 was published on 2019-06-17 and last updated on 2026-06-17.

CVE-2019-12789

CVE-2019-12789 is a medium-severity vulnerability in Actiontec T2200h Firmware with a CVSS 3.x base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.8)
CVSS v2: 7.2
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Actiontec T2200h Firmware
Published: 2019-06-17
Last modified: 2026-06-17

Description

An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system board, an attacker can use a special key sequence (Ctrl-\) to obtain a shell with root privileges. After gaining root access, the attacker can mount the filesystem read-write and make permanent modifications to the device including bricking of the device, disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on the device.

Frequently asked questions

What is CVE-2019-12789?: An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system board, an attacker can use a special key sequence (Ctrl-\) to obtain a shell with root privileges. After gaining root access, the attacker can mount the filesystem read-write and make permanent modifications to the device including bricking of the device, disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on the device.
How severe is CVE-2019-12789?: CVE-2019-12789 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-12789 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-12789?: CVE-2019-12789 affects Actiontec T2200h Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-12789?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-12789 published?: CVE-2019-12789 was published on 2019-06-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:actiontec:t2200h_firmware:t2200h-31.1238l.08:*:*:*:*:*:*:*