CVE-2019-17202

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege.

• CWE-269

• https://improsec.com/en/responsible-disclosureThird Party Advisory
• https://www.adminbyrequest.com/en/releasenotes
• https://improsec.com/en/responsible-disclosureThird Party Advisory
• https://www.adminbyrequest.com/en/releasenotes

Published

Jan 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17192The WebRTC component in the Signal Private Messenger applica…9.8
• CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various unc…9.8
• CVE-2019-17197OpenEMR through 5.0.2 has SQL Injection in the Lifestyle dem…9.8
• CVE-2019-17199www/getfile.php in WPO WebPageTest 19.04 on Windows allows D…7.5
• CVE-2019-1720A vulnerability in the XML API of Cisco Expressway Series an…6.8
• CVE-2019-17201FastTrack Admin By Request 6.1.0.0 supports group policies t…7.8
• CVE-2019-17203TeamPass 2.1.27.36 allows Stored XSS at the Search page by s…5.4
• CVE-2019-17204TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Kn…5.4
• CVE-2019-17205TeamPass 2.1.27.36 allows Stored XSS by placing a payload in…6.1
• CVE-2019-17206Uncontrolled deserialization of a pickled object in models.p…9.8
• CVE-2019-17207A reflected XSS vulnerability was found in includes/admin/ta…5.4
• CVE-2019-1721A vulnerability in the phone book feature of Cisco Expresswa…6.5