CVE-2019-7276: Optergy Proton and Enterprise backdoor console allows remote root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and full root code execution on building control systems, combined with a 99.8th percentile EPSS score, makes this an urgent exposure despite the absence of KEV listing.

What it is

Optergy Proton and Enterprise devices expose a backdoor console that permits remote code execution with root privileges. The flaw is network-reachable and requires no authentication or user interaction, so any host that can reach the device can attempt it. It matters because these are building management system products, and full root control of a BMS controller can disrupt or manipulate physical building operations.

Impact

An attacker gains remote root-level code execution on the affected device, allowing full control of the system, its data and any connected building control functions.

Attack surface

Reached over the network via the exposed backdoor console, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.93384 (99.8th percentile), indicating strong predicted exploitation activity. Reference tags are only Third Party Advisory and VDB Entry, with no exploit tag, so public exploit code is not confirmed by the record.

What to do

• Apply the vendor fix for Optergy Proton/Enterprise; the record does not state a patched version, so confirm the current release with Optergy.
• Isolate BMS devices from untrusted networks and the internet; restrict management access to a dedicated, firewalled segment.
• Block or disable the backdoor console service and any unnecessary management interfaces on affected devices.
• Require VPN or jump-host access with authentication for all administrative reachability to these devices.
• Monitor vendor advisories and the Applied Risk AR-2019-008 advisory for updated remediation guidance.

Detection

• Alert on unexpected inbound connections to Optergy management or console ports from outside the authorized management segment.
• Monitor device logs and process activity for unexpected command execution or new processes running as root.
• Baseline normal BMS traffic and flag anomalous outbound connections or configuration changes from Proton/Enterprise hosts.
• Inventory all Optergy Proton and Enterprise devices on the network to confirm which are exposed and unpatched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.