CiscoCVELIST:CVE-2019-1976CVE-2019-1976 Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.8%
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials.
CNA Affected
[
{
"product": "Cisco Industrial Network Director ",
"vendor": "Cisco",
"versions": [
{
"lessThan": "1.6.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.8%