{"id":"CVE-2019-12091","aliases":["EUVD-2019-3743","GHSA-h567-88r9-48gj"],"status":"published","title":"Netskope client command injections vulnerability","description":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00921,"percentile":0.60616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2019-09-26T15:18:00Z","modified":"2026-06-17T02:14:02Z","products":[{"vendor":"netskope","product":"netskope"},{"vendor":"netskope","product":"netskope client"}],"references":[{"url":"https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","Release Notes","Vendor Advisory"]},{"url":"https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://airbus-seclab.github.io/advisories/netskope.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12091"},{"url":"https://github.com/advisories/GHSA-h567-88r9-48gj"}],"sources":{"cve":[{"id":"CVE-2019-12091","title":"Netskope client command injections vulnerability","description":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.","status":"published","published":"2019-09-26T15:18:00Z","modified":"2024-08-04T23:10:30.196Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-3743","description":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.","status":"published","published":"2019-09-26T15:18:00Z","modified":"2024-08-04T23:10:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:47.406732Z"}],"ghsa":[{"id":"GHSA-h567-88r9-48gj","title":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT...","description":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.","status":"published","published":"2022-05-24T16:56:56Z","modified":"2024-04-04T02:00:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:56:05.019773Z"}],"nvd":[{"id":"CVE-2019-12091","description":"The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.","status":"published","published":"2019-09-26T16:15:11.003Z","modified":"2026-06-17T02:14:02.383Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:30.039477Z"}]}}