CVE-2018-11314: Roku Firmware

Critical severity, CVSS 9.6. EPSS: 1.9% chance of exploitation in the next 30 days.

The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.

Affected products

• Roku Roku Firmware: affected versions not specified

Published 2018-07-03. Last modified 2026-06-17.