CVE-2019-7671: Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an…

PriorityP260critical9CVSS 3.1

AVNACLPRLUIRSCCHIHAH

EXPLOIT

EPSS

8.26%

94.2th percentile

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
primasystems	flexair	<= 2.3.38	—

Detection & IOCsextracted from sources · hover to see the quote

→Monitor POST requests to /bin/sysfcgi.fx containing unsanitized script injection payloads in the HwName parameter, indicative of stored XSS exploitation. ↗
→Inspect the Session-ID and Session-Pc custom headers in HTTP requests to /bin/sysfcgi.fx; their presence alongside XSS payloads indicates authenticated exploitation of CVE-2019-7671. ↗

·Exploitation requires prior authentication to the Prima Access Control web interface; unauthenticated access alone is insufficient to trigger the stored XSS. ↗
·The vulnerability affects Prima Systems FlexAir versions 2.3.38 and prior; detections should be scoped to this version range. ↗

CVSS provenance

nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.