CVE-2019-7670

EPSS 18.3%

Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/155271/FlexAir-Access-Control-2.3.38-Remote-Root.htmlunverified exploitdbwww.exploit-db.com/exploits/47612unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/155271/FlexAir-Access-Control-2.3.38-Remote-Root.html https://applied-risk.com/labs/advisories https://www.us-cert.gov/ics/advisories/icsa-19-211-02