Main
Vulnerability Database
Exploits
ID:5722 - Exploit for OS Command Injection in inSync Client for Windows - CVE-2019-3999
ID:5722 - Exploit for OS Command Injection in inSync Client for Windows - CVE-2019-3999
Published: June 17, 2021
Vulnerability identifier: #VU48697
Vulnerability risk: Low
CVE-ID: CVE-2019-3999
CWE-ID: CWE-78
Exploitation vector: Local access
Vulnerable software:
inSync Client for Windows
inSync Client for Windows
Link to public exploit:
Vulnerability description
The vulnerability allows a local user to execute arbitrary shell commands on the target system with elevated privileges.
The vulnerability exists due to improper input validation in Windows Druva inSync Client Service (inSyncCPHwnet64.exe) when processing RPC requests. A local user can pass specially crafted data to the application to port 6064/tcp and execute arbitrary OS commands with SYSTEM privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install updates from vendor's website.