PT-2019-18660 · Tyco+1 · Exacqvision Enterprise System Manager+1

Bzyo · Published 2019-06-18 · Updated 2020-08-24 · CVE-2019-7588

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions exacqVision Enterprise System Manager (ESM) versions 5.12.2 and prior

Description A vulnerability in the exacqVision Enterprise System Manager (ESM) allows unauthorized privilege escalation. This issue impacts ESM running on a Windows operating system, where authorized users have 'modify' permission to the ESM folders. A low-privilege account can modify files in these directories, rename and replace an executable with a malicious file, and potentially achieve system-level privileges upon system restart.

Recommendations For versions 5.12.2 and prior, consider restricting access to the ESM folders to prevent low-privilege accounts from modifying files, and avoid restarting the system until a fix is applied. As a temporary workaround, consider monitoring system restarts and executable files in the ESM directories for any malicious activity. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-7588

Affected Products

Windows

Exacqvision Enterprise System Manager

References · 6

• 🔥 https://packetstormsecurity.com/files/151691/exacqvisionesm5122-escalate.txt · Exploit
• https://osv.dev/vulnerability/CVE-2019-7588 · Vendor Advisory
• https://exacq.com/kb?crc=31399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7588 · Security Note
• https://johnsoncontrols.com/-/media/jci/be/united-states/specialty-pages/product-security/files/cpp-psa-2019-01-v2-exacqvision-esm.pdf · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-164-01 · Note