Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentica...

CVE-2019-20451 · published 6 years ago
Summary

The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
samsung prismview_player_11 13.09.1100
cpe:2.3:a:samsung:prismview_player_11:13.09.1100:*:*:*:*:*:*:*
samsung prismview_system_9 11.10.17.00
cpe:2.3:a:samsung:prismview_system_9:11.10.17.00:*:*:*:*:*:*:*
Original advisory text
The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentica...
The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
8% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published10 Feb 2020
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-20451 · NVD
Track software like this
Free during beta