← volver
CVE-2019-9189

CVE-2019-9189

EPSS 11.6%
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
Productos afectados
n/a · n/a
PoCs públicas encontradas — 2
cve_referencepacketstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.htmlno verificadoexploitdbwww.exploit-db.com/exploits/47634no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.htmlhttps://applied-risk.com/index.php/download_file/view/199/165https://applied-risk.com/labs/advisorieshttps://applied-risk.com/resources/ar-2019-007https://www.us-cert.gov/ics/advisories/icsa-19-211-02