ByteOS Network

NVD Vulnerability Details :

CVE-2019-9507

Analyzed

Source-cret@cert.org

Published At-30 Mar, 2020 | 22:15

Updated At-03 Nov, 2021 | 19:32

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code syntax before executing. Since all commands within the web application are executed as root, this could allow a remote attacker authenticated with an administrator account to execute arbitrary commands as root.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	8.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Primary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CPE Matches

vertiv>>avocent_umg-4000_firmware>>4.2.1.19

cpe:2.3:o:vertiv:avocent_umg-4000_firmware:4.2.1.19:*:*:*:*:*:*:*

vertiv>>avocent_umg-4000>>-

cpe:2.3:h:vertiv:avocent_umg-4000:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-77	Primary	nvd@nist.gov
CWE-95	Secondary	cret@cert.org

References

Hyperlink	Source	Resource
https://www.vertiv.com/en-us/support/software-download/it-management/avocent-universal-management-gateway-appliance--software-downloads/	cret@cert.org	Vendor Advisory
https://www.vertiv.com/en-us/support/software-download/software/trellis-enterprise-and-quick-start-solutions-software-downloads/	cret@cert.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History