CVE-2019-7667
📋 TL;DR
Prima Systems FlexAir access control systems generate database backup files with predictable names, allowing attackers to brute-force download these files. This exposes login credentials, enabling authentication bypass and full system access. Affects FlexAir versions 2.3.38 and earlier.
💻 Affected Systems
- Prima Systems FlexAir Access Control
📦 What is this software?
Flexair by Primasystems
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative access, credential theft, and potential physical access control bypass.
Likely Case
Authentication bypass leading to unauthorized access to the access control system and sensitive data exposure.
If Mitigated
Limited impact if database backups are properly secured and network access is restricted.
🎯 Exploit Status
Exploitation requires only HTTP access and simple brute-forcing of predictable filenames.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.3.39 or later
Vendor Advisory: https://www.applied-risk.com/resources/ar-2019-007
Restart Required: Yes
Instructions:
1. Contact Prima Systems for updated software version 2.3.39 or later. 2. Backup current configuration. 3. Apply the update following vendor instructions. 4. Restart the system. 5. Verify the fix.
🔧 Temporary Workarounds
Restrict network access
linuxBlock external access to FlexAir web interface and backup directories
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable automatic backups
allTurn off automatic database backup generation if not required
Check FlexAir configuration interface for backup settings
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FlexAir systems from untrusted networks
- Monitor web server logs for unusual access patterns to backup files
🔍 How to Verify
Check if Vulnerable:
Check if running FlexAir version 2.3.38 or earlier via web interface or system informationCheck Version:
Check web interface at http://[system-ip]/status or similar endpointVerify Fix Applied:
Verify system is running version 2.3.39 or later and test if predictable backup files are accessible📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to backup file patterns
- Successful downloads of database backup files
Network Indicators:
- HTTP requests to predictable backup filenames (e.g., backup_*.db, *.bak)
SIEM Query:
source="web_logs" AND (uri="*backup*" OR uri="*.db" OR uri="*.bak") AND status=200🔗 References
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html
- https://applied-risk.com/labs/advisories
- https://www.applied-risk.com/resources/ar-2019-007
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html
- https://applied-risk.com/labs/advisories
- https://www.applied-risk.com/resources/ar-2019-007
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02
