PT-2020-11343 · March Networks · March Networks Command Client

Joachim Kerschbaumer · Published 2020-04-01 · Updated 2020-04-03 · CVE-2019-9163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions March Networks Command Client versions prior to 2.7.2

Description The connection initiation process in March Networks Command Client allows remote attackers to execute arbitrary code via crafted XAML objects.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-9163

Affected Products

March Networks Command Client

References · 5

• https://marchnetworks.com/cve-2019-9163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9163 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9163 · Vendor Advisory
• https://t.me/cvenotify/2342 · Telegram Post
• https://t.me/cibsecurity/10918 · Telegram Post