#VU48697 OS Command Injection in inSync Client for Windows - CVE-2019-3999

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU48697

#VU48697 OS Command Injection in inSync Client for Windows - CVE-2019-3999

Published: February 25, 2020 / Updated: June 17, 2021


Vulnerability identifier: #VU48697
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear
CVE-ID: CVE-2019-3999
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability: Public exploit is available
Vulnerable software:
inSync Client for Windows
Software vendor:
Druva

Description

The vulnerability allows a local user to execute arbitrary shell commands on the target system with elevated privileges.

The vulnerability exists due to improper input validation in Windows Druva inSync Client Service (inSyncCPHwnet64.exe) when processing RPC requests. A local user can pass specially crafted data to the application to port 6064/tcp and execute arbitrary OS commands with SYSTEM privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links