Skip to content
Fencer Vulns
critical 9.8

CVE-2019-5096 in the critical feed json

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server ap…

published 2019-12-03 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-14701

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
67.2%
EPSS 67.2% chance of exploitation in 30 days, percentile 99.3%
public exploits
0
none known

Summary

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-026-06 updated cvss 9.8

Rockwell Automation products using GoAhead Web Server

  • Rockwell Automation 1732E-8CFGM8R/A 1.012 Rockwell Automation 1732E-8IOLM12R 2.011 Rockwell Automation 1732E-IB8M8SOER 1.012 Rockwell Automation 1732E-IF4M12R/A (discontinued) 1.012 Rockwell Automation 1732E-IR4IM12R/A 1.012 Rockwell Automation 1732E-IT4IM12R/A 1.012
    +21 more products
    Rockwell Automation 1732E-OB8M8SR/A 1.013 Rockwell Automation 1732E-OF4M12R/A 1.012 Rockwell Automation 1747-AENTR 2.002 Rockwell Automation 1756- EN2T/D 11.001 Rockwell Automation 1756-EN2F/C 11.001 Rockwell Automation 1756-EN2T/D <= 11.001 Rockwell Automation 1756-EN2TP/A 11.001 Rockwell Automation 1756-EN2TR/C <= 11.001, 11.001 Rockwell Automation 1756-EN2TSC/B 10.01 Rockwell Automation 1756-EN2TSC/B (discontinued) 10.01 Rockwell Automation 1756-HIST1G/A (discontinued) <= 3.054 Rockwell Automation 1756-HIST2G/A(discontinued) <= 3.054 Rockwell Automation 1756-HIST2G/B <= 5.103 Rockwell Automation 1765 - EN3TR/B 11.001 Rockwell Automation 1769-AENTR 1.001 Rockwell Automation 5069-AEN2TR 3.011 Rockwell Automation Compact GuardLogix 5380 controllers 31 - 32 Rockwell Automation CompactLogix 5380 controllers 28 - 32 Rockwell Automation CompactLogix 5480 controllers 32 Rockwell Automation ControlLogix 5580 controllers 28 - 32 Rockwell Automation GuardLogix 5580 controllers 31 - 32
    affected: mitigation “1769-AENTR: Update to 1.003 or later” rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

67.21% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a EmbedThis

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.