CVE-2019-16278

CRITICAL KEV NUCLEI

Nostromo nhttpd <1.9.6 - RCE

Title source: llm

Description

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

Exploits (21)

nomisec WORKING POC 70 stars
by jas502n · remote
https://github.com/jas502n/CVE-2019-16278
nomisec WORKING POC 9 stars
by imjdl · remote
https://github.com/imjdl/CVE-2019-16278-PoC
nomisec WORKING POC 8 stars
by AnubisSec · remote
https://github.com/AnubisSec/CVE-2019-16278
nomisec WORKING POC 6 stars
by aN0mad · remote
https://github.com/aN0mad/CVE-2019-16278-Nostromo_1.9.6-RCE
nomisec WORKING POC 3 stars
by andknownmaly · remote
https://github.com/andknownmaly/CVE-2019-16278
nomisec WORKING POC 3 stars
by ianxtianxt · remote
https://github.com/ianxtianxt/CVE-2019-16278
nomisec WORKING POC 1 stars
by darkerego · remote
https://github.com/darkerego/Nostromo_Python3
nomisec WORKING POC 1 stars
by Kr0ff · remote
https://github.com/Kr0ff/cve-2019-16278
nomisec WORKING POC 1 stars
by cancela24 · remote
https://github.com/cancela24/CVE-2019-16278-Nostromo-1.9.6-RCE
nomisec WORKING POC
by NHPT · remote
https://github.com/NHPT/CVE-2019-16278
nomisec WORKING POC
by alexander-fernandes · remote
https://github.com/alexander-fernandes/CVE-2019-16278
nomisec WORKING POC
by CybermonkX · remote
https://github.com/CybermonkX/CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution
nomisec WORKING POC
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2019-16278
nomisec WORKING POC
by FredBrave · remote
https://github.com/FredBrave/CVE-2019-16278-Nostromo-1.9.6-RCE
nomisec WORKING POC
by keshiba · remote
https://github.com/keshiba/cve-2019-16278
gitlab WORKING POC
by Kr0ff · poc
https://gitlab.com/Kr0ff/cve-2019-16278
metasploit WORKING POC GOOD
rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/nostromo_code_exec.rb
vulncheck_xdb WORKING POC
remote
https://github.com/n3rdh4x0r/CVE-2019-16278
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/47573
vulncheck_xdb WORKING POC
remote
https://github.com/Ghostdust-u/pentest
exploitdb WORKING POC VERIFIED
by Kr0ff · pythonremotemultiple
https://www.exploit-db.com/exploits/47837

Nuclei Templates (1)

nostromo 1.9.6 - Remote Code Execution
CRITICALby pikpikcu

Scores

CVSS v3 9.8
EPSS 0.9439
EPSS Percentile 100.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2024-11-07
VulnCheck KEV 2020-05-07
InTheWild.io 2024-11-07
ENISA EUVD EUVD-2019-7077

Classification

CWE
CWE-22
Status published

Affected Products (1)

nazgul/nostromo_nhttpd < 1.9.7

Timeline

Published Oct 14, 2019
KEV Added Nov 07, 2024
Tracked Since Feb 18, 2026