CVE-2019-9189

—

CVSS 3.0

8.8 high

EPSS

12%p96

Published

Jun 5, 2019 (Jun 5, 2019)

Modified

Jun 17, 2026

Description

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

Vendors: primasystems
Products: flexair
Weakness: CWE-434
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (11.6%)

In the news0 stories

No ingested article mentions this CVE yet.