CVE-2019-6544 Privilege escalation in GE Communicator
An unprivileged user can execute scheduled scripts with system administrator privileges via a service, requiring non-default firewall settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6544?
CVE-2019-6544 is a medium-severity vulnerability in GE Communicator, published on 9 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrative actions, which may allow the execution of scheduled scripts with system administrator privileges. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.
Weakness: CWE-284
Which versions are affected by CVE-2019-6544?
It affects 1 product.
Products include Ge Ge Communicator.
How do I fix CVE-2019-6544?
No fix has been published for CVE-2019-6544 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6544 being exploited?
There is no known exploitation of CVE-2019-6544 in the wild and no public exploit code.
Other vulnerabilities in GE Communicator
Sources
Also known as GHSA-26m3-w3qj-hwgj.