CVE-2019-5164CWE-306

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2

High · published December 3, 2019

CVSS v3.0
7.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00763 · 54.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2019-12-03T21:56Z
EPSS history
Timeline
  • 03 DEC 21:56Z
    An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2
    cvelistv5