CVE-2019-7588

A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not impact any Windows Server OSs, or Linux deployments with permissions that are not inherited from the root directory. Authorized Users have ‘modify’ permission to the ESM folders, which allows a low privilege account to modify files located in these directories. An executable can be renamed and replaced by a malicious file that could connect back to a bad actor providing system level privileges. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of the malicious file. This issue affects: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) Version 5.12.2 and prior versions; This issue does not affect: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) 19.03 and above.

• CWE-276

• https://exacq.com/kb?crc=31399Mitigation, Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-164-01Third Party Advisory, US Government Resource
• https://packetstormsecurity.com/files/151691/exacqvisionesm5122-escalate.txtExploit, Third Party Advisory, VDB Entry
• https://www.johnsoncontrols.com/-/media/jci/be/united-states/specialty-pages/product-security/files/cpp-psa-2019-01-v2-exacqvision-esm.pdfMitigation, Third Party Advisory
• https://exacq.com/kb?crc=31399Mitigation, Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-164-01Third Party Advisory, US Government Resource
• https://packetstormsecurity.com/files/151691/exacqvisionesm5122-escalate.txtExploit, Third Party Advisory, VDB Entry
• https://www.johnsoncontrols.com/-/media/jci/be/united-states/specialty-pages/product-security/files/cpp-psa-2019-01-v2-exacqvision-esm.pdfMitigation, Third Party Advisory

Published

Jun 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7579An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 d…
• CVE-2019-7580ThinkCMF 5.0.190111 allows remote attackers to execute arbit…
• CVE-2019-7581The parseSWF_ACTIONRECORD function in util/parser.c in libmi…
• CVE-2019-7582The readBytes function in util/read.c in libming through 0.4…
• CVE-2019-7585An issue was discovered in Waimai Super Cms 20150505. web/Li…
• CVE-2019-7587Bo-blog Wind through 1.6.0-r allows SQL Injection via the ad…
• CVE-2019-7589A vulnerability with the SmartService API Service option exi…9.8
• CVE-2019-7590ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcps…6.7
• CVE-2019-7593Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
• CVE-2019-7594Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
• CVE-2019-7608Kibana versions before 5.6.15 and 6.6.1 had a cross-site scr…
• CVE-2019-7609Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary…10