Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6544

GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrative actions, which may allow the execution of scheduled scripts with system administrator privileges. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.

Published

2019-05-09T15:29:04.903

Last Modified

2024-11-21T04:46:39.983

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.6 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-284
Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ge	ge_communicator	< 4.0.517	Yes

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-122-02 Mitigation, Third Party Advisory, US Government Resource ([email protected])
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-02 Mitigation, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)