CVE-2019-19895 - In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system

Back Back to CVE browser

HIGH

In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system

Published Jan 23, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.45%

Description

In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by modifying %SYSTEMDRIVE%\IXP\SW\[PACKAGE_CODE]\EveryLogon.bat, achieve this movement and execute code in the context of other users.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9488
Advisory
https://improsec.com/tech-blog/multiple-vulnerabilities-in-easyinstall-rmm-and-deployment-software
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9488		Advisory
https://improsec.com/tech-blog/multiple-vulnerabilities-in-easyinstall-rmm-and-deployment-software		x_refsource_MISCExploitThird Party Advisory