CVE-2019-5629 Privilege escalation in Insight Agent
A local attacker can escalate to SYSTEM privileges by exploiting an uncontrolled DLL search path in Rapid7 Insight Agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5629?
CVE-2019-5629 is a high-severity vulnerability in Rapid7 Insight Agent, published on 13 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.
Weakness: CWE-427
Which versions are affected by CVE-2019-5629?
It affects 1 product.
Products include Rapid7 Insight Agent.
How do I fix CVE-2019-5629?
No fix has been published for CVE-2019-5629 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5629 being exploited?
There is no known exploitation of CVE-2019-5629 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Insight Agent
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
- CVE-2023-2273 Rapid7 Insight Agent Directory Traversal
Sources
Also known as GHSA-hwwf-273g-8x77.