CVE-2019-12928
CRITICALQemu < 4.0.0 - Exposure to Wrong Actor
Title source: ruleDescription
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Exploits (1)
metasploit
WORKING POC
EXCELLENT
by bcoles · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/qemu_monitor_hmp_migrate_cmd_exec.rb
Scores
CVSS v3
9.8
EPSS
0.5409
EPSS Percentile
98.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
CWE-668
Status
published
Products (1)
qemu/qemu
< 4.0.0
Published
Jun 24, 2019
Tracked Since
Feb 18, 2026