← Back

CVE-2019-9486

nvd nist
Published: Apr 30, 2019Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject and execute code by hijacking the insecure communications with the service. This vulnerability also affects Telekom MagentaCLOUD through 5.7.0.0 and 1&1 Online Storage through 6.1.0.0.

Affected (3)

Strato
1 product
Hidrive Desktop Client
Telekom
1 product
Magentacloud
Ionos
1 product
1&1 Online Storage
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Hidrive Desktop Client
Up to 5.0.1.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Magentacloud
Up to 5.7.0.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
1&1 Online Storage
Up to 6.1.0.0

Related CWEs

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (2)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.