Vulnerability Description
The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code syntax before executing. Since all commands within the web application are executed as root, this could allow a remote attacker authenticated with an administrator account to execute arbitrary commands as root.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vertiv | Avocent Umg-4000 Firmware | 4.2.1.19 |
| Vertiv | Avocent Umg-4000 | - |
Related Weaknesses (CWE)
References
- https://www.vertiv.com/en-us/support/software-download/it-management/avocent-uniVendor Advisory
- https://www.vertiv.com/en-us/support/software-download/software/trellis-enterpriVendor Advisory
- https://www.vertiv.com/en-us/support/software-download/it-management/avocent-uniVendor Advisory
- https://www.vertiv.com/en-us/support/software-download/software/trellis-enterpriVendor Advisory
FAQ
What is CVE-2019-9507?
CVE-2019-9507 is a vulnerability with a CVSS score of 8.3 (HIGH). The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code syntax before executing. Since all commands wi...
How severe is CVE-2019-9507?
CVE-2019-9507 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9507?
Check the references section above for vendor advisories and patch information. Affected products include: Vertiv Avocent Umg-4000 Firmware, Vertiv Avocent Umg-4000.