Skip to content
Fencer Vulns
high 7.8

CVE-2019-6534 json

The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 e…

published 2019-04-11 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16093

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-078-01 updated cvss 6.5

AVEVA InduSoft Web Studio and InTouch Edge HMI

  • AVEVA Software, LLC InduSoft Web Studio < 8.1 SP3 AVEVA Software, LLC InTouch Edge HMI < 2017 Update 3
    affected: vendor fix, mitigation “InduSoft Web Studio: v8.1 SP3” softwaresupportsp.schneider-electric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-19-073-02 updated cvss 6.5

Gemalto Sentinel UltraPro

  • Gemalto Sentinel UltraPro Client Library ux32w.dll 1.3.0, 1.3.1, 1.3.2
    affected: mitigation “Users who have Sentinel UltraPro Client Library ux32w.versions v1.3.0, v1.3.1 or v1.3.2 are advised to upgrade to Sentinel UtraPro v1.3.3 in order to enable this security update.” supportportal.gemalto.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Gemalto Sentinel UltraPro

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.