CVE-2019-7590 - Unquoted Search Path or Element

Severity

46%

Complexity

39%

Confidentiality

106%

ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.

ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.

CVSS 3.0 Base Score 7.8. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 4.6. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P).

Demo Examples

Unquoted Search Path or Element

CWE-428

The following example demonstrates the weakness.


               
UINT errCode = WinExec( "C:\\Program Files\\Foo\\Bar", SW_SHOW );

Overview

Type

Johnsoncontrols ExacqVision Server

First reported 5 years ago

2019-07-19 21:15:00

Last updated 5 years ago

2020-02-10 21:53:00

Affected Software

Johnsoncontrols ExacqVision Server 9.6

9.6

Johnsoncontrols ExacqVision Server 9.8

9.8

References

109307

Third Party Advisory, VDB Entry

https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341

Patch, Third Party Advisory

https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html

Exploit, Third Party Advisory, VDB Entry

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Mitigation, Vendor Advisory

https://www.us-cert.gov/ics/advisories/icsa-19-199-01

Third Party Advisory, US Government Resource

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.