CVEvulnerability

CVE-2019-11031

9.8 CRITICAL Published 2019-08-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-434

Description

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.

Affected configurations

• mirasys mirasys vms (< 7.6.1) • mirasys mirasys vms (>= 8.0.0 < 8.3.2)

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References