Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1879

A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploit this vulnerability by authenticating with the administrator password via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.

Published

2019-06-20T03:15:12.290

Last Modified

2024-11-21T04:37:36.020

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.4 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Secondary
CWE-78
Type: Primary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cisco	unified_computing_system	4.0\(1c\)hs3	Yes
Application	cisco	integrated_management_controller	-	Yes

References

http://www.securityfocus.com/bid/108850 Third Party Advisory, VDB Entry ([email protected])
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-cimc-cli-cmdinj Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/108850 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-cimc-cli-cmdinj Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)