What’s Vulnerable › Vulnerabilities

CVE-2019-9486

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-30 · updated 2026-06-17
• Weakness: CWE-367

Description

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject and execute code by hijacking the insecure communications with the service. This vulnerability also affects Telekom MagentaCLOUD through 5.7.0.0 and 1&1 Online Storage through 6.1.0.0.

Affected products

• Ionos 1&1 Online Storage: through 6.1.0.0
• Strato Hidrive Desktop Client: through 5.0.1.0
• Telekom Magentacloud: through 5.7.0.0

References

• https://zer0-day.pw/articles/2019-04/HiDrive-LPE-via-Insecure-WCF-endpoint
• https://zer0-day.pw/articles/2019-04/HiDrive-LPE-via-Insecure-WCF-endpoint

Get alerted when CVE-2019-9486 or the next vulnerability affects your stack