PT-2020-10288 · Ixp · Ixp Easyinstall

Published 2020-01-23 · Updated 2021-07-21 · CVE-2019-19895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions IXP EasyInstall version 6.2.13723

Description The issue allows for lateral movement using the Agent Service against other users on a client system. An authenticated attacker can modify the EveryLogon.bat file located at %SYSTEMDRIVE%IXPSW[PACKAGE CODE] to achieve this movement and execute code in the context of other users.

Recommendations For IXP EasyInstall version 6.2.13723, consider restricting access to the EveryLogon.bat file to prevent unauthorized modifications until a patch is available. Additionally, monitor system activity for suspicious modifications to this file.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-19895

Affected Products

Ixp Easyinstall

References · 3

• 🔥 https://improsec.com/tech-blog/multiple-vulnerabilities-in-easyinstall-rmm-and-deployment-software · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19895 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19895 · Vendor Advisory