CVE-2019-9189 - CVE House
Back to Database
Status published High CVE-2019-9189

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows...

Vulnerability Description

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9189

Credits & Attribution

No credits recorded in the NVD database.

References

More from primasystems

View All →
CVE-2019-7672
Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version...
High 8.8
CVE-2019-7671
Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to...
Critical 9
CVE-2019-7670
Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly...
High 7.2
CVE-2019-7669
Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of...
High 8.8
CVE-2019-7668
Prima Systems FlexAir devices have Default Credentials....
Critical 9.8

Affected Vendor

primasystems

View all reports →

Affected Software

flexair
Vulnerable Versions:
0

Timeline

Official Publish: June 5th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.