Lucene search

[email protected]CVE-2019-1864

HistoryAug 21, 2019 - 7:15 p.m.

CVE-2019-1864

2019-08-2119:15:14

CWE-78

[email protected]

web.nvd.nist.gov

cve-2019-1864

cisco

imc

software

vulnerability

remote attacker

root privileges

nvd

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending malicious commands to the web-based management interface of the affected software. A successful exploit could allow the attacker, with read-only privileges, to inject and execute arbitrary, system-level commands with root privileges on an affected device.

Affected configurations

NVD

Node

ciscounified_computing_systemMatch4.0\(1c\)hs3

Node

ciscoencs_5100Match-

ciscoencs_5400Match-

ciscoucs-e1120d-m3Match-

ciscoucs-e140s-m2Match-

ciscoucs-e160d-m2Match-

ciscoucs-e160s-m3Match-

ciscoucs-e168d-m2Match-

ciscoucs-e180d-m3Match-

ciscoucs_c125_m5Match-

ciscoucs_c4200Match-

ciscoucs_s3260Match-

AND

ciscointegrated_management_controller_supervisorRange1.5.0.0–1.5\(9g\)

ciscointegrated_management_controller_supervisorRange2.0.0.0–2.0\(13o\)

ciscointegrated_management_controller_supervisorRange3.0.0.0–3.0\(4k\)

ciscointegrated_management_controller_supervisorRange4.0.0.0–4.0\(4b\)

Node

ciscointegrated_management_controller_supervisorRange4.0.0.0–4.0\(1d\)

AND

ciscoencs_5100Match-

ciscoencs_5400Match-

ciscoucs-e1120d-m3Match-

ciscoucs-e140s-m2Match-

ciscoucs-e160d-m2Match-

ciscoucs-e160s-m3Match-

ciscoucs-e168d-m2Match-

ciscoucs-e180d-m3Match-

ciscoucs_c125_m5Match-

ciscoucs_c4200Match-

ciscoucs_s3260Match-

Node

ciscointegrated_management_controller_supervisorRange4.0.0.0–4.0\(2c\)

AND

ciscoencs_5100Match-

ciscoencs_5400Match-

ciscoucs-e1120d-m3Match-

ciscoucs-e140s-m2Match-

ciscoucs-e160d-m2Match-

ciscoucs-e160s-m3Match-

ciscoucs-e168d-m2Match-

ciscoucs-e180d-m3Match-

ciscoucs_c125_m5Match-

ciscoucs_c4200Match-

ciscoucs_s3260Match-

CPENameOperatorVersion
cisco:unified_computing_systemcisco unified computing systemeq4.0\(1c\)hs3

CPE	Name	Operator	Version
cisco:unified_computing_system	cisco unified computing system	eq	4.0\(1c\)hs3

CNA Affected

[
  {
    "product": "Cisco Unified Computing System E-Series Software (UCSE) ",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "2.0(13o)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-cmdinj-1864

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

Related for CVE-2019-1864

cvelist1 prion1 nvd1 cisco1