Skip to main content
No exploitation reportedFix available

CVE-2019-12775

No exploitation reported by the sources we read.

  • Published2019-06-07
  • WeaknessCWE-269

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.)

Timeline

dates in UTC
  1. 2019-06-0716:29CVE publishedNVD

Versions per branch

NVD
Enttec datagate mk2 firmwareversion to verify
BranchAffectedFixed in
70044.x= 70044no fix published
Enttec e-streamer mk2 firmwareversion to verify
BranchAffectedFixed in
70044.x= 70044no fix published
Enttec pixelator firmwareversion to verify
BranchAffectedFixed in
70044.x= 70044no fix published

1 more product in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-20-177-01 CISA4 known affected

    ENTTEC Lighting Controllers (Update A)

    Datagate Mk2: firmware Version 70044_update_05032019-482 and prior · E-Streamer Mk2 (End of Life): firmware Version 70044_update_05032019-482 and prior · Pixelator: firmware Version 70044_update_05032019-482 and prior · +1 more

Full record on NVD

Fix

  1. Vendor fix CISA ICSA-20-177-01 · 4 productsENTTEC has released RevB (June 2020) firmware that provides additional security measures to mitigate these vulnerabilities. ENTTEC recommends the Datagate Mk2, Storm 24, and Pixelator units should be updated to RevB (June 2020) firmware or newer. Once the firmware is updated and the device is confi…
  2. Mitigation from the vendor CISA ICSA-20-177-01 · 4 productsThe E-Streamer Mk2 is discontinued and is no longer supported by ENTTEC. ENTTEC recommends upgrading to the S-PLAY to replace this product.
  3. Mitigation from the vendor CISA ICSA-20-177-01 · 4 productsENTTEC recommends devices should be located behind appropriate firewalls and network controls, and not accessible from the Internet.

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
2019-06-07
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-qjf6-m28x-r7cx

Frequently asked questions

What is CVE-2019-12775?

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.)

Is CVE-2019-12775 actively exploited?

Active exploitation of CVE-2019-12775 has not been confirmed. Its EPSS score was 1.8% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2019-12775?

CVE-2019-12775 has a CVSS v3 base score of 8.8 (HIGH severity), with vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record