CVE-2019-16328

EPSS 13.0%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 13.0%KEV nãoPoC —Nuclei —Metasploit simPatch referenciado

Lifecycle

03 Oct 2019Published on NVD

19 Feb 2023Metasploit module available

Weaponization speed

1234 daysto Metasploit module

Recommendation: Plan a near-term fix — a public PoC already exists.

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

Affected products

n/a · n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html https://github.com/tomerfiliba/rpyc https://rpyc.readthedocs.io/en/latest/docs/security.html