Lucene search

JciCVELIST:CVE-2019-7590

HistoryJul 19, 2019 - 8:56 p.m.

CVE-2019-7590 exacqVision Server Unquoted Service Path

2019-07-1920:56:07

CWE-428

jci

www.cve.org

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

ExacqVision Server’s services ‘exacqVisionServer’, ‘dvrdhcpserver’ and ‘mdnsresponder’ have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.

CNA Affected

[
  {
    "product": "exacqVision Server",
    "vendor": "Exacq Technologies, Inc.",
    "versions": [
      {
        "lessThan": "8.4",
        "status": "unknown",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.4",
        "status": "unaffected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.6"
      },
      {
        "status": "affected",
        "version": "9.8"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "next of 19.03",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/109307

gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341

packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html

www.johnsoncontrols.com/cyber-solutions/security-advisories

www.us-cert.gov/ics/advisories/icsa-19-199-01

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

Related for CVELIST:CVE-2019-7590