CVE-2019-9189

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

• CWE-434

• http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html
• https://applied-risk.com/index.php/download_file/view/199/165Third Party Advisory
• https://applied-risk.com/labs/advisoriesThird Party Advisory
• https://applied-risk.com/resources/ar-2019-007Third Party Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02
• http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html
• https://applied-risk.com/index.php/download_file/view/199/165Third Party Advisory
• https://applied-risk.com/labs/advisoriesThird Party Advisory
• https://applied-risk.com/resources/ar-2019-007Third Party Advisory
• https://www.us-cert.gov/ics/advisories/icsa-19-211-02

Published

Jun 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9182There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save…
• CVE-2019-9183An issue was discovered in Contiki-NG through 4.3 and Contik…7.5
• CVE-2019-9184SQL injection vulnerability in the J2Store plugin 3.x before…
• CVE-2019-9185Controller/Async/FilesystemManager.php in the filemanager in…
• CVE-2019-9186In several JetBrains IntelliJ IDEA versions, a Spring Boot r…
• CVE-2019-9187ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3…
• CVE-2019-9191The ETSI Enterprise Transport Security (ETS, formerly known …
• CVE-2019-9192In the GNU C Library (aka glibc or libc6) through 2.29, chec…
• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" f…
• CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability…
• CVE-2019-9195util/src/zip.rs in Grin before 1.0.2 mishandles suspicious f…9.8
• CVE-2019-9196The Face authentication component in Aware mobile liveness 2…