7.8

CVE-2019-1883

Cisco Integrated Management Controller CLI Command Injection Vulnerability

A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input on the command-line interface. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow an attacker to execute arbitrary commands on the device with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Unified Computing System Version 4.0(1c)hs3
Cisco ≫ Integrated Management Controller Supervisor Version >= 3.0.0.0 < 3.0\(4k\)
   Cisco ≫ Encs 5100 Version -
   Cisco ≫ Encs 5400 Version -
   Cisco ≫ Ucs-e1120d-m3 Version -
   Cisco ≫ Ucs-e140s-m2 Version -
   Cisco ≫ Ucs-e160d-m2 Version -
   Cisco ≫ Ucs-e160s-m3 Version -
   Cisco ≫ Ucs-e168d-m2 Version -
   Cisco ≫ Ucs-e180d-m3 Version -
   Cisco ≫ Ucs C125 M5 Version -
   Cisco ≫ Ucs C4200 Version -
   Cisco ≫ Ucs S3260 Version -
Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(4b\)
   Cisco ≫ Encs 5100 Version -
   Cisco ≫ Encs 5400 Version -
   Cisco ≫ Ucs-e1120d-m3 Version -
   Cisco ≫ Ucs-e140s-m2 Version -
   Cisco ≫ Ucs-e160d-m2 Version -
   Cisco ≫ Ucs-e160s-m3 Version -
   Cisco ≫ Ucs-e168d-m2 Version -
   Cisco ≫ Ucs-e180d-m3 Version -
   Cisco ≫ Ucs C125 M5 Version -
   Cisco ≫ Ucs C4200 Version -
   Cisco ≫ Ucs S3260 Version -
Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(2f\)
   Cisco ≫ Encs 5100 Version -
   Cisco ≫ Encs 5400 Version -
   Cisco ≫ Ucs-e1120d-m3 Version -
   Cisco ≫ Ucs-e140s-m2 Version -
   Cisco ≫ Ucs-e160d-m2 Version -
   Cisco ≫ Ucs-e160s-m3 Version -
   Cisco ≫ Ucs-e168d-m2 Version -
   Cisco ≫ Ucs-e180d-m3 Version -
   Cisco ≫ Ucs C125 M5 Version -
   Cisco ≫ Ucs C4200 Version -
   Cisco ≫ Ucs S3260 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.326
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Cisco PSIRT 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-cimc-cli-inject
Vendor Advisory