What’s Vulnerable › Vulnerabilities

CVE-2019-9189

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-05 · updated 2026-06-17
• Weakness: CWE-434

Description

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

Affected products

• Primasystems Flexair: through 2.3.38

References

• http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html
• https://applied-risk.com/index.php/download_file/view/199/165
• https://applied-risk.com/labs/advisories
• https://applied-risk.com/resources/ar-2019-007
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02
• http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html
• https://applied-risk.com/index.php/download_file/view/199/165
• https://applied-risk.com/labs/advisories
• https://applied-risk.com/resources/ar-2019-007
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02

Get alerted when CVE-2019-9189 or the next vulnerability affects your stack