CVE-2019-6544

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrative actions, which may allow the execution of scheduled scripts with system administrator privileges. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	GE Communicator	All versions prior to 4.0.517

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-122-02Mitigation, Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-02Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: May 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65457.5AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20 CVE-2019-65467.8GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whi CVE-2019-65475.5Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the softw CVE-2019-65489.8GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the CVE-2019-65497.2An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software CVE-2019-65509.8Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper valida CVE-2019-65517.5Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafte CVE-2019-65529.8Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of us CVE-2019-65539.8A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLi CVE-2019-65547.5Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-ser CVE-2019-65557.8Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may CVE-2019-65566.6When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to c