VULNERABILITY INTELLIGENCE

CVE-2019-12091

CVSS score7.8 HIGH

EPSS probability0.92%

CISA KEVNot currently listed

Published2019-09-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\SYSTEM privilege.

Weakness classification

cert@airbus.com: CWE-78
nvd@nist.gov: CWE-78

Primary references

cert@airbus.com — Third Party Advisory
cert@airbus.com — Permissions Required, Release Notes, Vendor Advisory
cert@airbus.com — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory