CVE-2019-9507 - CVE House
Back to Database
Status published High CVE-2019-9507

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code execution

Vulnerability Description

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code syntax before executing. Since all commands within the web application are executed as root, this could allow a remote attacker authenticated with an administrator account to execute arbitrary commands as root.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9507

Credits & Attribution

No credits recorded in the NVD database.

References

More from Vertiv

View All →
CVE-2025-46412
Vertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or Channel
Critical 9.3
CVE-2025-41426
Vertiv Liebert RDU101 and UNITY Stack-based Buffer Overflow
Critical 9.3
CVE-2022-50927
Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
High 8.5
CVE-2019-9509
The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected cross site scripting
Medium 6.3
CVE-2019-9508
Vertiv Avocent UMG-4000 version 4.2.1.19 web interface is vulnerable to stored cross site scripting
Medium 6.3

Affected Vendor

Affected Software

Avocent UMG-4000
Vulnerable Versions:
4.2.1.19

Timeline

Official Publish: March 30th, 2020
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.