CVE-2019-18249

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-24 · updated 2026-06-17
Weakness: CWE-79

Description

Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26.4), may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link.

Affected products

Reliablecontrols Mach-Prowebcom Firmware: before 8.26.4 — fixed in 8.26.4
Reliablecontrols Mach-Prowebsys Firmware: before 8.26.4 — fixed in 8.26.4

How to fix

Upgrade to a fixed version: Reliablecontrols Mach-Prowebcom Firmware 8.26.4; Reliablecontrols Mach-Prowebsys Firmware 8.26.4. Check the vendor advisory for mitigations.

References

https://www.us-cert.gov/ics/advisories/icsa-19-353-04
https://www.us-cert.gov/ics/advisories/icsa-19-353-04

Get alerted when CVE-2019-18249 or the next vulnerability affects your stack