Vulnerability Description
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mirasys | Mirasys Vms | < 7.6.1 |
Related Weaknesses (CWE)
References
- https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-manaThird Party Advisory
- https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-manaThird Party Advisory
FAQ
What is CVE-2019-11030?
CVE-2019-11030 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserial...
How severe is CVE-2019-11030?
CVE-2019-11030 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-11030?
Check the references section above for vendor advisories and patch information. Affected products include: Mirasys Mirasys Vms.