CVE-2019-6447: ES File Explorer Android app exposes unauthenticated file read and app execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.1 with no authentication or user interaction required, public exploit code, and very high EPSS, though exploitation is limited to the local network segment.

What it is

ES File Explorer File Manager through 4.1.9.7.4 leaves TCP port 59777 open after first launch and answers unauthenticated HTTP requests with application/json data. An attacker on the same Wi-Fi network can use those requests to read arbitrary files or launch applications on the device. The flaw is a missing-authentication issue in a widely installed Android file manager.

Impact

An attacker gains read access to arbitrary files on the device and the ability to execute applications, which can expose stored data and enable further actions on the victim's phone.

Attack surface

Reachable over the local Wi-Fi network via TCP port 59777 using unauthenticated HTTP requests; no credentials or user interaction are required, and the port stays open after the app has been launched once.

Exploitation

Public exploit code is referenced (Packet Storm and a GitHub PoC), and EPSS is 0.6378 (99.18th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Update ES File Explorer to a version later than 4.1.9.7.4, or remove the app if no fixed version is available.
• Block or monitor TCP port 59777 on local networks and on device firewalls.
• Avoid running the app on untrusted or shared Wi-Fi networks.
• Restrict local network access between devices where possible (client isolation, segmentation).

Detection

• Monitor network traffic for HTTP requests to TCP port 59777 on local networks.
• Scan Android devices on the network for an open TCP port 59777.
• Alert on application/json POST or GET requests directed at port 59777 from unexpected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.