CVE-2019-7667

CVE-2019-7667 affects Prima Systems FlexAir (versions 2.3.38 and prior). The flaw is that database backup files are created with predictable names, allowing brute-force identification of the backup file. An attacker could download the backup, obtain login information, and bypass authentication to...

CVE-2019-7666

CVE-2019-7666 affects Prima Systems FlexAir (versions 2.3.38 and earlier). The vulnerability is improper authentication via the MD5 hash of the password, potentially allowing an attacker with database access to log in as admin without decrypting the password. Public sources in the connected docs ...

CVE-2019-7671

CVE-2019-7671 affects Prima Systems FlexAir (Versions 2.3.38 and earlier). The issue is an authenticated Stored XSS vector where parameters sent to scripts are not properly sanitized, potentially allowing code execution in a user’s browser context. Public PoCs exist (e.g., HwName Stored XSS via P...

CVE-2019-7670

CVE-2019-7670 affects Prima Systems FlexAir (Versions 2.3.38 and earlier). The vulnerability is an OS command injection caused by improper neutralization of elements that could modify commands sent to downstream components. This could allow an attacker to execute commands on the operating system....

CVE-2019-9189

Summary of CVE-2019-9189 (FlexAir): Prima Systems FlexAir, versions 2.4.9api3 and earlier, allows uploading arbitrary Python scripts when configuring the main central controller. These scripts can be executed immediately with root privileges, enabling an authenticated attacker to gain full system...

CVE-2019-7280

The CVE affects Prima Systems FlexAir up to version 2.3.38. The issue is that the session-ID is of insufficient length, allowing brute-force attempts to obtain a valid session and bypass authentication, potentially enabling remote access. Public references describe multiple CVEs in the same relea...

CVE-2019-7669

CVE-2019-7669 affects Prima Systems FlexAir (versions 2.3.38 and earlier). The vulnerability is due to improper validation of file extensions when uploading files, allowing a remote authenticated attacker to upload and execute malicious applications within the application’s web root with root pri...

CVE-2019-7281

CVE-2019-7281 affects Prima Systems FlexAir (versions 2.3.38 and earlier). The vulnerability is CSRF: an unauthenticated user can cause unverified HTTP requests that may let an attacker perform actions with administrative privileges when a logged-in user visits a malicious site. The ICSA advisory...

CVE-2019-7672

Affected software: Prima Systems FlexAir, versions 2.3.38 and earlier. Vulnerability: Use of hard-coded username/password in the flash web interface enables an authenticated attacker to escalate privileges. Root cause: hard-coded credentials in the Web UI. Impact: potential privilege escalation o...

CVE-2019-7668

CVE-2019-7668 concerns Prima Systems FlexAir devices with default credentials. Connected sources indicate a default-password vulnerability in FlexAir (notably version 2.3.38 and earlier per CNVD-2019-21067). The root cause is weak/default credentials allowing unauthorized access to networked Flex...