CVE-2019-7670

HIGH

Prima Systems FlexAir <2.3.38 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-7670. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit leverages a command injection vulnerability in Prima FlexAir Access Control 2.3.38 via the SetNTPServer request. It allows authenticated remote code execution by injecting commands into the Server parameter and retrieving output from a specified file.

Description

Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · pythonwebappshardware
https://www.exploit-db.com/exploits/47612

This exploit leverages a command injection vulnerability in Prima FlexAir Access Control 2.3.38 via the SetNTPServer request. It allows authenticated remote code execution by injecting commands into the Server parameter and retrieving output from a specified file.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Prima FlexAir Access Control 2.3.38
Auth required
Prerequisites: Valid session ID · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://applied-risk.com/labs/advisories
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-211-02
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/155271/FlexAir-Access-Control-2.3.38-Remote-Root.html

Scores

CVSS v3 7.2
EPSS 0.1831
EPSS Percentile 96.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
primasystems/flexair < 2.3.38
Published Jul 01, 2019
Tracked Since Feb 18, 2026