CVE-2019-5459: ABB Ability Camera Connect multiple vulnerabilities in VLC component

CVE-2019-5459 · Severity: high · CVSS 9.8 · Published 2026-05-26

ABB Ability Camera Connect, a software solution used for managing industrial camera systems, includes an outdated version of the VLC media player. This third-party component contains multiple security flaws that could allow an attacker to crash the system or take full control of the computer running the software. While the risk is lower in isolated industrial networks, a successful exploit could lead to unauthorized access to sensitive operational data or disruption of monitoring services.

Vendors: ABB.

Quick answers

Is CVE-2019-5459 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-5459 being exploited in the wild.
How severe is CVE-2019-5459?
High severity, with a CVSS score of 9.8, published 26 May 2026.
Which products and versions are affected?
ABB Ability Camera Connect <=1.5.0.14, 1.5.0.15.
Is there a fix for CVE-2019-5459?
A patch was published on 2026-05-26: ABB released version 1.5.0.15 to address the vulnerabilities Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-5459 attacked?
It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2019-5459?
Check whether you run ABB Ability Camera Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ABB Ability Camera Connect (versions 1.5.0.14 and below) bundles an outdated version of VLC media player (v2.2.4) which is susceptible to numerous critical vulnerabilities. These include heap-based buffer overflows, integer overflows, and out-of-bounds writes (e.g., CVE-2024-46461, CVE-2023-47359). An attacker can exploit these by providing maliciously crafted media files or network streams (such as MMS), potentially leading to arbitrary code execution with the privileges of the target user or a denial-of-service condition. Additionally, a binary hijacking vulnerability in the VLC uninstaller (CVE-2023-46814) could allow local privilege escalation to SYSTEM. ABB has released version 1.5.0.15 to address these issues by updating the third-party components.

Affected products

  • ABB Ability Camera Connect <=1.5.0.14, 1.5.0.15

Identifiers

  • CVE-2019-5459
  • CVE-2023-47359
  • CVE-2019-13602
  • CVE-2018-11529
  • CVE-2017-8311
  • CVE-2017-17670
  • CVE-2017-8312
  • CVE-2019-19721
  • CVE-2017-10699
  • CVE-2019-5460
  • CVE-2017-9301
  • CVE-2023-47360
  • CVE-2019-13615
  • CVE-2022-41325
  • CVE-2019-13962
  • CVE-2017-8313
  • CVE-2023-46814
  • CVE-2017-9300
  • CVE-2020-26664
  • CVE-2019-5439
  • CVE-2017-8310
  • CVE-2024-46461

Timeline

  • 2026-05-26: advisory: CISA Advisory ICSA-26-146-05 published
  • 2026-05-26: patched: ABB released version 1.5.0.15 to address the vulnerabilities

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.