CVE-2019-9189

moderate-risk
Published 2019-06-05

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

Do I need to act?

!
20.0% chance of exploitation in next 30 days
EPSS score — higher than 80% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
47634
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Primasystems

References (10)

http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-U...
Third Party Advisory https://applied-risk.com/index.php/download_file/view/199/165
Third Party Advisory https://applied-risk.com/labs/advisories
Third Party Advisory https://applied-risk.com/resources/ar-2019-007
https://www.us-cert.gov/ics/advisories/icsa-19-211-02
http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-U...
Third Party Advisory https://applied-risk.com/index.php/download_file/view/199/165
Third Party Advisory https://applied-risk.com/labs/advisories
Third Party Advisory https://applied-risk.com/resources/ar-2019-007
https://www.us-cert.gov/ics/advisories/icsa-19-211-02
49
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 14/34 · Moderate
Exposure 5/34 · Minimal