CVE-2019-15119 cnlh nps vulnerable to file overwrite by local user
Local attackers can overwrite the NPS binary due to insecure file permissions, enabling privilege escalation and arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-15119?
CVE-2019-15119 is a medium-severity vulnerability in n/a, published on 16 Aug 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
Weakness: CWE-732
Which versions are affected by CVE-2019-15119?
3 open source packages ship an affected version, including ehang.io/nps and github.com/cnlh/nps. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ehang.io/nps Go | All versions | 0.23.2 |
ehang.io/nps Go | All versions | 0.23.2 |
github.com/cnlh/nps Go | All versions | 0.23.2 |
Products include Ehang-Io Nps.
How do I fix CVE-2019-15119?
Upgrade ehang.io/nps to 0.23.2 or later.
Is CVE-2019-15119 being exploited?
There is no known exploitation of CVE-2019-15119 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2vp2-8m5j-4rjx, GO-2025-3625.