Vulnerability Description
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Johnsoncontrols | Exacqvision Server | 9.6 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/109307Third Party AdvisoryVDB Entry
- https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190fPatchThird Party Advisory
- https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-PaExploitThird Party AdvisoryVDB Entry
- https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesMitigationVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-199-01Third Party AdvisoryUS Government Resource
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.phpThird Party Advisory
- http://www.securityfocus.com/bid/109307Third Party AdvisoryVDB Entry
- https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190fPatchThird Party Advisory
- https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-PaExploitThird Party AdvisoryVDB Entry
- https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesMitigationVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-199-01Third Party AdvisoryUS Government Resource
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.phpThird Party Advisory
FAQ
What is CVE-2019-7590?
CVE-2019-7590 is a vulnerability with a CVSS score of 6.7 (MEDIUM). ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it poten...
How severe is CVE-2019-7590?
CVE-2019-7590 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-7590?
Check the references section above for vendor advisories and patch information. Affected products include: Johnsoncontrols Exacqvision Server.