Strix
26.1K

CVE-2019-20451

CRITICALCVSS 9.8/10EPSS 7.53%

Last modified

CVE-2019-20451 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.). EPSS estimates a 7.53% chance of exploitation in the next 30 days.

Description

The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
7.53%

93.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SamsungPrismview Player 1113.09.1100
SamsungPrismview System 911.10.17.00

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-20451?
The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)
How severe is CVE-2019-20451?
CVE-2019-20451 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 7.53% probability of exploitation in the next 30 days.
How do I fix CVE-2019-20451?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-20451?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST