CVE-2019-19165 Code injection in Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) on Windows 7/8/10
Remote attackers can download and execute arbitrary files via the AxECM.cab ActiveX control in Inogard Ebiz4u on Windows systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19165?
CVE-2019-19165 is a high-severity code injection vulnerability in Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) on Windows 7/8/10, published on 29 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded and executed by setting arguments to the activeX method. Download of Code Without Integrity Check vulnerability in ActiveX control of Inogard Co,,LTD Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) allows ATTACKER to cause a file download to Windows user's folder and execute. This issue affects: Inogard Co,,LTD Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) version 1.0.5.0 and later versions on windows 7/8/10.
Weakness: CWE-494
Which versions are affected by CVE-2019-19165?
It affects 1 product.
Products include Inogard Activex.
How do I fix CVE-2019-19165?
No fix has been published for CVE-2019-19165 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-19165 being exploited?
There is no known exploitation of CVE-2019-19165 in the wild and no public exploit code.
Sources
Also known as GHSA-8w7w-fq7p-rq7r.