CVE-2019-15020 Command injection in Palo Alto Networks Zingbox Inspector
An attacker can supply a malicious update image to the Zingbox Inspector to execute arbitrary commands on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15020?
CVE-2019-15020 is a critical command injection vulnerability in Palo Alto Networks Zingbox Inspector, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection.
Weakness: CWE-346
Which versions are affected by CVE-2019-15020?
It affects 1 product.
Products include Zingbox Inspector.
How do I fix CVE-2019-15020?
No fix has been published for CVE-2019-15020 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-15020 being exploited?
There is no known exploitation of CVE-2019-15020 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks Zingbox Inspector
- CVE-2019-15019 Other in Palo Alto Networks Zingbox Inspector
- CVE-2019-1584 Command injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-15014 Command injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-15016 SQL injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-15015 Hardcoded credentials in Palo Alto Networks Zingbox Inspector
Sources
Also known as GHSA-x299-8ccg-m7c3.