CVE-2019-1935 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability

🗓️ 21 Aug 2019 18:25:23Reported by ciscoType

Cisco IMC, UCS Director Default Credentials Vulnerabilit

Reporter	Title	Published	Views	Family All 18
0day.today	Cisco UCS Director, Cisco Integrated Management Controller Supervisor - Multiple Vulnerabilities	29 Aug 201900:00	–	zdt
0day.today	Cisco UCS Director Default scpuser Password Exploit	2 Sep 201900:00	–	zdt
BDU FSTEC	The vulnerability of the Supervisor component of the Cisco Integrated Management Controller (IMC), as well as the physical infrastructure management tools and Cisco UCS Director and Cisco UCS Director Express for Big Data virtual environments, is related to the existence of a standard account with an undocumented password and incorrect access rights settings for this account. This allows an attacker to gain access to the command-line interface of the target system with administrator privileges.	30 Aug 201900:00	–	bdu_fstec
Circl	CVE-2019-1935	2 Sep 201915:56	–	circl
Cisco	Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability	21 Aug 201916:00	–	cisco
Tenable Nessus	Cisco UCS Director SCP User Default Credentials (cisco-sa-20190821-imcs-usercred)	11 Dec 201900:00	–	nessus
CNVD	Cisco Integrated Management Controller Supervisor, Cisco UCS Director and Cisco UCS Director Express for Big Data Trust Management Issue Vulnerabilities	26 Aug 201900:00	–	cnvd
CVE	CVE-2019-1935	21 Aug 201918:25	–	cve
Exploit DB	Cisco UCS Director - default scpuser password (Metasploit)	3 Sep 201900:00	–	exploitdb
exploitpack	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	21 Aug 201900:00	–	exploitpack

[
  {
    "product": "Cisco Unified Computing System Director",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.7.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
seclists	www.seclists.org/fulldisclosure/2019/Aug/36
seclists	www.seclists.org/bugtraq/2019/Aug/49
packetstormsecurity	www.packetstormsecurity.com/files/154305/Cisco-UCS-Director-Default-scpuser-Password.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred
packetstormsecurity	www.packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html

02 Sep 2019 20:06Current

9.8High risk

Vulners AI Score9.8

CVSS 39.8

EPSS0.88998

CWE-798