CVE-2019-8272
Last modified
CVE-2019-8272 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. EPSS estimates a 3.92% chance of exploitation in the next 30 days.
Description
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Uvnc | Ultravnc | < 1.2.2.3 |
| Siemens | Sinumerik Access Mymachine\/P2p | < 4.8 |
| Siemens | Sinumerik Pcu Base Win10 Software\/Ipc | < 14.00 |
| Siemens | Sinumerik Pcu Base Win7 Software\/Ipc | <= 12.01 |
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdfThird Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06Third Party Advisory, US Government Resource
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdfThird Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-8272?
How severe is CVE-2019-8272?
How do I fix CVE-2019-8272?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-8266UltraVNC revision 1207 has multiple out-of-bounds access vul…
- CVE-2019-8267UltraVNC revision 1207 has out-of-bounds read vulnerability …
- CVE-2019-8268UltraVNC revision 1206 has multiple off-by-one vulnerabiliti…9.8
- CVE-2019-8269UltraVNC revision 1206 has stack-based Buffer overflow vulne…7.5
- CVE-2019-8270UltraVNC revision 1210 has out-of-bounds read vulnerability …
- CVE-2019-8271UltraVNC revision 1211 has a heap buffer overflow vulnerabil…9.8
- CVE-2019-8273UltraVNC revision 1211 has a heap buffer overflow vulnerabil…9.8
- CVE-2019-8274UltraVNC revision 1211 has a heap buffer overflow vulnerabil…9.8
- CVE-2019-8275UltraVNC revision 1211 has multiple improper null terminatio…9.8
- CVE-2019-8276UltraVNC revision 1211 has a stack buffer overflow vulnerabi…7.5
- CVE-2019-8277UltraVNC revision 1211 contains multiple memory leaks (CWE-6…7.5
- CVE-2019-8278Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 le…
Are you affected by CVE-2019-8272?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST