CVE-2019-20049

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass authentication) with an insecure file upload to achieve Remote Code Execution as SYSTEM. The directory traversal is in the __construct() whereas the insecure file upload is in SetSkinImages().

• https://git.lsd.cat/g/omnivista-rceExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.al-enterprise.com/en/-/media/assets/internet/documents/sa-c0065-ov8770-rce-vulnerability-en.pdfVendor Advisory
• https://www.exploit-db.com/exploits/47761Exploit, Third Party Advisory, VDB Entry
• https://git.lsd.cat/g/omnivista-rceExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.al-enterprise.com/en/-/media/assets/internet/documents/sa-c0065-ov8770-rce-vulnerability-en.pdfVendor Advisory
• https://www.exploit-db.com/exploits/47761Exploit, Third Party Advisory, VDB Entry

Published

Dec 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-con…4.3
• CVE-2019-20044In Zsh before 5.8, attackers able to execute commands can re…7.8
• CVE-2019-20045The Synergy Systems & Solutions PLC & RTU system has a vulne…7.5
• CVE-2019-20046The Synergy Systems & Solutions PLC & RTU system has a vulne…9.8
• CVE-2019-20047An issue was discovered on Alcatel-Lucent OmniVista 4760 dev…7.5
• CVE-2019-20048An issue was discovered on Alcatel-Lucent OmniVista 8770 dev…7.2
• CVE-2019-2005In onPermissionGrantResult of GrantPermissionsActivity.java,…
• CVE-2019-20050Pandora FMS ≤ 7.42 suffers from a remote code execution vuln…6.8
• CVE-2019-20051A floating-point exception was discovered in PackLinuxElf::e…5.5
• CVE-2019-20052A memory leak was discovered in Mat_VarCalloc in mat.c in ma…6.5
• CVE-2019-20053An invalid memory address dereference was discovered in the …5.5
• CVE-2019-20054In the Linux kernel before 5.0.6, there is a NULL pointer de…5.5