CVE-2019-13558

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	WebAccess	Versions 8.4.1 and prior

References

https://www.us-cert.gov/ics/advisories/icsa-19-260-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-19-260-01Third Party Advisory, US Government Resource

Timeline

Published: Sep 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-135597.8GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited ap CVE-2019-13566.5An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft E CVE-2019-135609.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter CVE-2019-135619.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_f CVE-2019-135626.1D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping CVE-2019-135638.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.CVE-2019-135646.1XSS exists in Ping Identity Agentless Integration Kit before 1.5.CVE-2019-135657.5An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL securi CVE-2019-135669.8An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow CVE-2019-135678.8The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpene CVE-2019-135688.8CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.CVE-2019-135699.8A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitat