CVE-2019-1935

🗓️ 21 Aug 2019 19:15:15Reported by [email protected]Type

A vulnerability in Cisco IMC Supervisor, UCS Director, and UCS Director Express allows remote attacker to log in using SCP User account default credentials and execute arbitrary commands

Reporter	Title	Published	Views	Family All 18
0day.today	Cisco UCS Director, Cisco Integrated Management Controller Supervisor - Multiple Vulnerabilities	29 Aug 201900:00	–	zdt
0day.today	Cisco UCS Director Default scpuser Password Exploit	2 Sep 201900:00	–	zdt
BDU FSTEC	The vulnerability of the Supervisor component of the Cisco Integrated Management Controller (IMC), as well as the physical infrastructure management tools and Cisco UCS Director and Cisco UCS Director Express for Big Data virtual environments, is related to the existence of a standard account with an undocumented password and incorrect access rights settings for this account. This allows an attacker to gain access to the command-line interface of the target system with administrator privileges.	30 Aug 201900:00	–	bdu_fstec
Circl	CVE-2019-1935	2 Sep 201915:56	–	circl
Cisco	Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability	21 Aug 201916:00	–	cisco
Tenable Nessus	Cisco UCS Director SCP User Default Credentials (cisco-sa-20190821-imcs-usercred)	11 Dec 201900:00	–	nessus
CNVD	Cisco Integrated Management Controller Supervisor, Cisco UCS Director and Cisco UCS Director Express for Big Data Trust Management Issue Vulnerabilities	26 Aug 201900:00	–	cnvd
CVE	CVE-2019-1935	21 Aug 201918:25	–	cve
Cvelist	CVE-2019-1935 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability	21 Aug 201918:25	–	cvelist
Exploit DB	Cisco UCS Director - default scpuser password (Metasploit)	3 Sep 201900:00	–	exploitdb

NVD

Node

cisco integrated_management_controller_supervisorRange2.2.0.0–2.2.0.6

cisco integrated_management_controller_supervisorMatch2.1.0.0

Node

cisco ucs_directorMatch6.0.0.0

cisco ucs_directorMatch6.5.0.0

cisco ucs_directorMatch6.6.0.0

cisco ucs_directorMatch6.6.1.0

cisco ucs_directorMatch6.7(0.0.67265)

cisco ucs_directorMatch6.7.0.0

cisco ucs_directorMatch6.7.1.0

Node

cisco ucs_director_express_for_big_dataMatch3.0.0.0

cisco ucs_director_express_for_big_dataMatch3.5.0.0

cisco ucs_director_express_for_big_dataMatch3.6.0.0

cisco ucs_director_express_for_big_dataMatch3.7.0.0

cisco ucs_director_express_for_big_dataMatch3.7.1.0

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html
seclists	www.seclists.org/fulldisclosure/2019/Aug/36
seclists	www.seclists.org/bugtraq/2019/Aug/49
packetstormsecurity	www.packetstormsecurity.com/files/154305/Cisco-UCS-Director-Default-scpuser-Password.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred

21 Nov 2024 04:37Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.88998

CWE-798