CVE-2019-12574 - A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges

Back Back to CVE browser

HIGH

A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges

Published Jul 11, 2019

7.8

HIGH

CVSS 3.0

EPSS 2.11%

Description

A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-426

References (1)

https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12574.txt
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12574.txt		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 11, 2019

Updated Aug 4, 2024

Reserved Jun 2, 2019

Link CVE-2019-12574

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-12574

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-12574