The exploit has been publicly known since 2019 but remains unpatched.