CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login information, which can allow the attacker to bypass authentication and have full access to the system.

• CWE-330

• http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.htmlExploit, Third Party Advisory, VDB Entry
• https://applied-risk.com/labs/advisoriesThird Party Advisory
• https://www.applied-risk.com/resources/ar-2019-007Third Party Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource
• http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.htmlExploit, Third Party Advisory, VDB Entry
• https://applied-risk.com/labs/advisoriesThird Party Advisory
• https://www.applied-risk.com/resources/ar-2019-007Third Party Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource

Published

Jul 1, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7661An issue was discovered in PHPMyWind 5.5. The method paramet…
• CVE-2019-7662An assertion failure was discovered in wasm::WasmBinaryBuild…6.5
• CVE-2019-7663An Invalid Address dereference was discovered in TIFFWriteDi…
• CVE-2019-7664In elfutils 0.175, a negative-sized memcpy is attempted in e…5.5
• CVE-2019-7665In elfutils 0.175, a heap-based buffer over-read was discove…5.5
• CVE-2019-7666Prima Systems FlexAir, Versions 2.3.38 and prior. The applic…8.8
• CVE-2019-7668Prima Systems FlexAir devices have Default Credentials.
• CVE-2019-7669Prima Systems FlexAir, Versions 2.3.38 and prior. Improper v…8.8
• CVE-2019-7670Prima Systems FlexAir, Versions 2.3.38 and prior. The applic…7.2
• CVE-2019-7671Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters…9
• CVE-2019-7672Prima Systems FlexAir, Versions 2.3.38 and prior. The flash …8.8
• CVE-2019-7673An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices.…