What’s Vulnerable › Vulnerabilities

CVE-2019-3727: OS command injection vulnerability

• Severity: medium (CVSS 6.7 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-05-15 · updated 2026-06-17
• Weakness: CWE-78

Description

Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installation feature of Boxmgmt CLI. A malicious boxmgmt user may potentially be able to execute arbitrary commands as root.

Affected products

• Dell Emc Recoverpoint: before 5.1.3 — fixed in 5.1.3
• Dell RecoverPoint for Virtual Machines: before 5.2.0.2 — fixed in 5.2.0.2

How to fix

Upgrade to a fixed version: Dell Emc Recoverpoint 5.1.3; Dell RecoverPoint for Virtual Machines 5.2.0.2. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/108411
• https://www.dell.com/support/security/us/en/04/details/533842/DSA-2019-078-Dell-EMC-RecoverPoint-OS-Command-Injection-Vulnerability
• http://www.securityfocus.com/bid/108411
• https://www.dell.com/support/security/us/en/04/details/533842/DSA-2019-078-Dell-EMC-RecoverPoint-OS-Command-Injection-Vulnerability

Get alerted when CVE-2019-3727 or the next vulnerability affects your stack