CVE-2019-9189
On Prima Systems FlexAir devices through 2.4.9api3, an authenticated user can upload Python (.py)...
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
- Record
CVE-2019-9189- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
- Record
CVE-2019-9189- Updated
- 2026-11-02
EUVDEUVD-2019-18566 No score
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
- Record
EUVD-2019-18566- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36c5-5h9q-3jvp No score
On Prima Systems FlexAir devices through 2.4.9api3, an authenticated user can upload Python (.py)...
On Prima Systems FlexAir devices through 2.4.9api3, an authenticated user can upload Python (.py) scripts and execute arbitrary code with root privileges.
- Record
GHSA-36c5-5h9q-3jvp- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Prima Access Control 2.3.35 - Arbitrary File Upload | 2019-11-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9189 is a high vulnerability (CVSS 8.8) in Primasystems Flexair, published June 5, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.4%, the 96th percentile. No source names a fixed version.
References
applied-risk.com/labs/advisories
us-cert.gov/ics/advisories/icsa-19-211-02
packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2019-9189
github.com/advisories/GHSA-36c5-5h9q-3jvp