FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow…
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasttracksoftware:admin_by_request:*:*:*:*:*:*:*:* | before 6.2.0.0 | Vulnerable | Fasttracksoftware |
- cpe:2.3:a:fasttracksoftware:admin_by_request:*:*:*:*:*:*:*:* Versions before 6.2.0.0 Vulnerable ·Fasttracksoftware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17202
- 2026-10-03 Alias added: GHSA-mxgh-5jc3-jf47
References
More Fasttracksoftware Admin By Request vulnerabilities
- TI-2019-12821 FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow… CVSS 3.1HIGH 7.8
Sources
- CVE-2019-17202 · CVE Program
- CVE-2019-17202 · NVD
- FIRST EPSS
- GHSA-mxgh-5jc3-jf47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences