CVE-2019-7590
exacqVision Server Unquoted Service Path
- State
- Published
- Severity
- 6.7 Medium
- Published
- Jul 19, 2019
- Updated
- Sep 17, 2024
- Reserved
- Feb 7, 2019
Description
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.7 Medium | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | jci |
Weaknesses
- CWE-428 Unquoted Search Path or Element
Affected Products
| Product | Versions |
|---|---|
exacqVision ServerExacq Technologies, Inc. |
|
References
- https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php
- https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341
- https://www.us-cert.gov/ics/advisories/icsa-19-199-01
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- 109307vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.