{"id":"CVE-2019-19875","aliases":["EUVD-2019-9468","GHSA-fvg6-36gh-2gwj"],"status":"published","title":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands...","description":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01518,"percentile":0.74738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2020-11-27T16:21:13Z","modified":"2026-06-17T02:27:22Z","products":[{"vendor":"br-automation","product":"industrial_automation_aprol"}],"references":[{"url":"https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19875"},{"url":"https://github.com/advisories/GHSA-fvg6-36gh-2gwj"}],"sources":{"cve":[{"id":"CVE-2019-19875","description":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.","status":"published","published":"2020-11-27T16:21:13Z","modified":"2024-08-05T02:32:09.359Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-9468","description":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.","status":"published","published":"2020-11-27T16:21:13Z","modified":"2024-08-05T02:32:09Z","updated_at":"2026-11-03T02:40:23.78072Z"}],"ghsa":[{"id":"GHSA-fvg6-36gh-2gwj","title":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands...","description":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.","status":"published","published":"2022-05-24T17:34:59Z","modified":"2023-01-29T05:05:28Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:45:47.837276Z"}],"nvd":[{"id":"CVE-2019-19875","description":"An issue was discovered in B\u0026R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.","status":"published","published":"2020-11-27T17:15:11.5Z","modified":"2026-06-17T02:27:22.757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:05:48.502374Z"}]}}