CVE-2019-11539highunder attackransomwareCWE-78

CVE-2019-11539

Published · Updated

Follow this CVE+ Monitor Pulse Connect Secure and Pulse Policy Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8epss 99%
from disclosure to weapon131 days
Published on NVDApr 26
1st PoC+131d
metasploitApr 24
CISA KEV+922d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

An authenticated attacker can inject and execute arbitrary commands through the admin web interface of Pulse Secure products, compromising the entire system. This is a critical flaw because it allows someone with login credentials to take complete control of the device.

Technical detail

CWE-78 command injection vulnerability in the admin web interface of Pulse Connect Secure and Pulse Policy Secure allows authenticated users to execute arbitrary OS commands. The attack vector requires valid administrator credentials and affects multiple product versions prior to specified patch levels; successful exploitation grants complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.