CVE-2019-19168

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
RAONwiz	Dext.ocx ActiveX Control in Dext5 Upload	>= 5.0.0.116 and prior, < 5.0.0.117

References

http://www.dext5.com/page/support/notice_view.aspx?pSeq=26Vendor Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352Third Party Advisory
http://www.dext5.com/page/support/notice_view.aspx?pSeq=26Vendor Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35352Third Party Advisory

Timeline

Published: May 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-191699.8Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by se CVE-2019-19179.8A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass CVE-2019-19187.4A vulnerability in the implementation of Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality CVE-2019-19197.8A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker w CVE-2019-191917.8Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service use CVE-2019-191926.5The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecu CVE-2019-191936.5The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5 CVE-2019-191948.8The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR CVE-2019-191956.5The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict lin CVE-2019-191966.5The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR CVE-2019-191977.8IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-serv CVE-2019-191985.4The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.