PT-2020-10289 · Ixp · Ixp Easyinstall

Published 2020-01-23 · Updated 2020-01-29 · CVE-2019-19896

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IXP EasyInstall version 6.2.13723

Description The issue allows for Remote Code Execution due to weak permissions on the Engine Service share. By default, the file permissions of the IXP$ share on the server permit modification of directories and files, such as bat-scripts. This enables the execution of code in the context of NT AUTHORITYSYSTEM on both the target server and clients.

Recommendations For IXP EasyInstall version 6.2.13723, consider restricting access to the IXP$ share to prevent unauthorized modifications, and review the permissions on the Engine Service share to ensure they are properly secured. As a temporary workaround, restrict write access to the IXP$ share to minimize the risk of exploitation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-19896

Affected Products

Ixp Easyinstall

References · 3

• 🔥 https://improsec.com/tech-blog/multiple-vulnerabilities-in-easyinstall-rmm-and-deployment-software · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19896 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19896 · Vendor Advisory