CVEvulnerability
CVE-2019-6447
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-01-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.8 MEDIUM — AV:A/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-306
Description
The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.
Affected configurations
• estrongs es file explorer file manager (<= 4.1.9.7.4)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://packetstormsecurity.com/files/163303/ES-File-Explorer-4.1.9.7.4-Arbitrary-File-Read.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/fs0c131y/ESFileExplorerOpenPortVuln Exploit, Third Party Advisory
- https://twitter.com/fs0c131y/status/1085460755313508352 Third Party Advisory
- http://packetstormsecurity.com/files/163303/ES-File-Explorer-4.1.9.7.4-Arbitrary-File-Read.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/fs0c131y/ESFileExplorerOpenPortVuln Exploit, Third Party Advisory
- https://twitter.com/fs0c131y/status/1085460755313508352 Third Party Advisory