QwikSec

Security Database

CVE

CWE

Training

CVE-2019-9189

Published: Jun 5, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://applied-risk.com/labs/advisories

x_refsource_MISC

https://applied-risk.com/index.php/download_file/view/199/165

x_refsource_MISC

https://applied-risk.com/resources/ar-2019-007

x_refsource_MISC

https://www.us-cert.gov/ics/advisories/icsa-19-211-02

x_refsource_MISC

http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.