CVE-2019-7590

ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.

Link	Resource
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php	Third Party Advisory
https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341	Patch Third Party Advisory
https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Mitigation Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-199-01	Third Party Advisory US Government Resource
https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html	Exploit Third Party Advisory
http://www.securityfocus.com/bid/109307	Third Party Advisory VDB Entry

Configuration 1

cpe:2.3:a:johnsoncontrols:exacqvision_server:9.8:*:*:*:*:*:*:* cpe:2.3:a:johnsoncontrols:exacqvision_server:9.6:*:*:*:*:*:*:*

---

Published : 2019-07-19 09:15

Updated : 2020-02-10 09:53

---

NVD link : CVE-2019-7590

Mitre link : CVE-2019-7590

No products.

CWE-428