---
title: "Pulse Secure Cmd Inject (CVE-2019-11539)"
canonical: https://trickest.com/library/cve-2019-11539-pulse-connect-secure-cmd-injection
description: "Flag Pulse Connect Secure for CVE-2019-11539 via GET /dana-na/nc/nc_gina_ver.txt. Floors 8.1.15.59747 / 8.2.12.64003 / 8.3.7.65025 / 9.0.3.64053. No cmd inject."
---

# Pulse Secure Cmd Inject (CVE-2019-11539)

## Overview

This workflow finds Ivanti Pulse Connect Secure and sorts each host by whether its version falls below the CVE-2019-11539 fixed floors. CVE-2019-11539 is authenticated admin command injection on vulnerable Pulse Connect Secure builds. This check never authenticates to the admin UI and never injects a command. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/dana-na/nc/nc_gina_ver.txt` only, fingerprints Pulse Connect Secure from that version text, reads the release string, and compares it to the per-branch floors in the graph. Builds on 9.1R1 and later are not affected. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when edge VPN appliances lag on maintenance releases. A gateway frozen on 9.0R3 before the fixed ProductVersion is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/dana-na/nc/nc_gina_ver.txt` on each host and fingerprint Pulse Connect Secure from the version text in that response.
3. Parse the release string and compare it to the CVE-2019-11539 floors in the graph (8.1.15.59747, 8.2.12.64003, 8.3.7.65025, 9.0.3.64053).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Pulse Connect Secure was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/dana-na/nc/nc_gina_ver.txt` only. No admin login and no command injection.

## Sample output

The records below are illustrative and do not come from a real run. They show one Pulse Connect Secure host below a CVE-2019-11539 floor, one at or above its floor, and one host that is not the product.

```jsonl
{"url": "https://vpn.example.com", "is_product": true, "product_version": "9.0.3.64050", "vulnerable": true, "detail": "below floor 9.0.3.64053"}
{"url": "https://vpn.example.org", "is_product": true, "product_version": "9.0.3.64053", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Pulse Connect Secure"}
```

```json
{"cve": "CVE-2019-11539", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Pulse Connect Secure versions does this flag?

Builds below the floors in the graph: 8.1.15.59747, 8.2.12.64003, 8.3.7.65025, and 9.0.3.64053. The 9.1R1 line and later are not affected. The compare uses the version text `/dana-na/nc/nc_gina_ver.txt` itself served.

### Does an affected row mean admin command injection worked?

No. The check only GETs `/dana-na/nc/nc_gina_ver.txt` and reads the version string. It does not log into admin and it does not confirm command injection or RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public version endpoint. It does not authenticate or run a command.

### Does the check need credentials?

No. It fingerprints the public version text the way an external scanner would.

### What is CVE-2019-11539?

Authenticated admin command injection in Ivanti Pulse Connect Secure on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Pulse Secure File Read (CVE-2019-11510)](/library/cve-2019-11510-pulse-connect-secure-file-read). Reach for it when you need the unauthenticated file-read check on the same VPN fleet.
- [Pulse Secure Code Inject (CVE-2020-8218)](/library/cve-2020-8218-pulse-connect-secure-admin-code-injection). Reach for it when you need the later admin code-injection fingerprint.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when you need a newer Ivanti auth bypass check.

---
_Markdown source of https://trickest.com/library/cve-2019-11539-pulse-connect-secure-cmd-injection._