PT-2020-9992 · Unknown · Enterprise Access Client Auto-Updater

Published 2020-08-25 · Updated 2020-09-01 · CVE-2019-18847

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Enterprise Access Client Auto-Updater versions prior to 2.0.1

Description: The issue allows for Remote Code Execution. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Auto-Updater feature until a patch is applied.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-18847

Affected Products

Enterprise Access Client Auto-Updater

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-18847 · Security Note
• https://blogs.akamai.com/sitr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18847 · Vendor Advisory
• https://blogs.akamai.com/2020/08/enterprise-application-access-client-eaa-vulnerability-cve-2019-18847.html · Vendor Advisory
• https://t.me/cibsecurity/14317 · Telegram Post
• https://t.me/rnetsec/13193 · Telegram Post
• https://t.me/secharvester/9762 · Telegram Post