What’s Vulnerable › Vulnerabilities

CVE-2019-11031

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-22 · updated 2026-06-17
• Weakness: CWE-434

Description

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.

Affected products

• Mirasys Vms: before 7.6.1; from 8.0.0 before 8.3.2 — fixed in 7.6.1, 8.3.2

How to fix

Upgrade to a fixed version: Mirasys Vms 7.6.1, 8.3.2. Check the vendor advisory for mitigations.

References

• https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution
• https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution

Get alerted when CVE-2019-11031 or the next vulnerability affects your stack