CVE-2019-20451
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on Prismview systems by uploading malicious shortcut files and triggering reboot commands. It affects Prismview System 9 and Prismview Player 11 installations with vulnerable versions. Attackers can obtain credentials from an accessible XML file to bypass authentication requirements.
💻 Affected Systems
- Prismview System 9
- Prismview Player 11
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to ransomware deployment, data exfiltration, or integration into botnets for further attacks.
Likely Case
Remote code execution allowing attackers to install backdoors, steal credentials, or disrupt display operations.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent credential access.
🎯 Exploit Status
Exploit requires obtaining credentials from accessible XML file first, then simple file upload and command execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Prismview vendor for updated versions
Vendor Advisory: Not publicly documented
Restart Required: Yes
Instructions:
1. Contact Prismview vendor for security updates. 2. Apply patches to affected systems. 3. Restart services after patching. 4. Verify HTTP API security settings.
🔧 Temporary Workarounds
Restrict HTTP API Access
windowsBlock external access to Prismview HTTP API using firewall rules
netsh advfirewall firewall add rule name="Block Prismview API" dir=in action=block protocol=TCP localport=80,443 remoteip=any
Secure Credential XML File
windowsRestrict access to XML files containing credentials using file permissions
icacls "C:\Path\To\Prismview\*.xml" /deny Everyone:(R)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Prismview systems from untrusted networks
- Monitor for suspicious file uploads to RebootSystem.lnk and requests to /REBOOTSYSTEM or /RESTARTVNC endpoints
🔍 How to Verify
Check if Vulnerable:
Check if system runs Prismview System 9 version 11.10.17.00 or earlier, or Prismview Player 11 version 13.09.1100 or earlier, and has HTTP API accessible.Check Version:
Check Prismview software interface or configuration files for version informationVerify Fix Applied:
Verify updated version is installed and test that /REBOOTSYSTEM and /RESTARTVNC endpoints no longer accept unauthorized requests.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /REBOOTSYSTEM or /RESTARTVNC endpoints
- File creation events for RebootSystem.lnk
- Authentication failures followed by XML file access
Network Indicators:
- HTTP POST requests with file uploads to Prismview API
- Unusual outbound connections from Prismview systems
SIEM Query:
source="prismview.log" AND (uri="/REBOOTSYSTEM" OR uri="/RESTARTVNC" OR file="RebootSystem.lnk")