CVE-2012-4249
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, ...
Affects 1 product across 1 vendor.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
This vulnerability was disclosed in 2012. A critical vulnerability affects Amazon systems (CVE-2012-4249). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
BSID: BS-2012-GLOBAL-306210-C • Model: rule-based-v1 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2012-4249?
What is the CVSS score for CVE-2012-4249?
Is CVE-2012-4249 actively exploited?
How do I remediate CVE-2012-4249?
What systems are affected by CVE-2012-4249?
| CVE ID | CVE-2012-4249 |
|---|---|
| BSID | BS-2012-GLOBAL-306210-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2012-08-12 |
| Last Modified | 2026-04-29 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than CVE-2012-4248.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than CVE-2012-4248. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.
Exploitation Likelihood: LOW
| Vendor | Product | Fixed Version |
|---|---|---|
| Amazon | Kindle Touch | — |
No patch URL on record. Monitor vendor security advisories directly.
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
SAGE Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | c84ad187656da5060d3d53f0dde5b17c31ca55d1cc0d52dff4a27572ce1e4ff4c38e12afbc2e5d6dc4f114d1aa2daa09b694fdb224b77401b439e840f0acf87b |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →