CVE-2019-1864

EPSS 1.47%
Published 21.08.2019 19:15:14
Last modified 21.11.2024 04:37:33
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending malicious commands to the web-based management interface of the affected software. A successful exploit could allow the attacker, with read-only privileges, to inject and execute arbitrary, system-level commands with root privileges on an affected device.

Affected products Warnungen 0 Metrics 4 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Unified Computing System Version4.0(1c)hs3

Cisco ≫ Integrated Management Controller Supervisor Version >= 1.5.0.0 < 1.5\(9g\)

   Cisco ≫ Encs 5100 Version-
   Cisco ≫ Encs 5400 Version-
   Cisco ≫ Ucs-e1120d-m3 Version-
   Cisco ≫ Ucs-e140s-m2 Version-
   Cisco ≫ Ucs-e160d-m2 Version-
   Cisco ≫ Ucs-e160s-m3 Version-
   Cisco ≫ Ucs-e168d-m2 Version-
   Cisco ≫ Ucs-e180d-m3 Version-
   Cisco ≫ Ucs C125 M5 Version-
   Cisco ≫ Ucs C4200 Version-
   Cisco ≫ Ucs S3260 Version-

Cisco ≫ Integrated Management Controller Supervisor Version >= 2.0.0.0 < 2.0\(13o\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 3.0.0.0 < 3.0\(4k\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(4b\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(1d\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(2c\)

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.47%	0.792

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C
psirt@cisco.com	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-cmdinj-1864

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-1864

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-1864

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-1864

EUVD