Lucene search

K
cveCiscoCVE-2019-1753
HistoryMar 28, 2019 - 12:29 a.m.

CVE-2019-1753

2019-03-2800:29:00
CWE-20
cisco
web.nvd.nist.gov
66
cisco
ios xe
software
vulnerability
web ui
input validation
remote attacker
privileged commands
nvd
cve-2019-1753

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

53.5%

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device’s web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

Affected configurations

Nvd
Vulners
Node
ciscoios_xeMatch3.2.0ja
OR
ciscoios_xeMatch3.6.10e
OR
ciscoios_xeMatch16.6.1
OR
ciscoios_xeMatch16.6.2
OR
ciscoios_xeMatch16.6.3
OR
ciscoios_xeMatch16.7.1
OR
ciscoios_xeMatch16.7.1a
OR
ciscoios_xeMatch16.7.1b
OR
ciscoios_xeMatch16.8.1
OR
ciscoios_xeMatch16.8.1a
OR
ciscoios_xeMatch16.8.1b
OR
ciscoios_xeMatch16.8.1c
OR
ciscoios_xeMatch16.8.1d
OR
ciscoios_xeMatch16.8.1e
OR
ciscoios_xeMatch16.8.1s
VendorProductVersionCPE
ciscoios_xe3.2.0jacpe:2.3:o:cisco:ios_xe:3.2.0ja:*:*:*:*:*:*:*
ciscoios_xe3.6.10ecpe:2.3:o:cisco:ios_xe:3.6.10e:*:*:*:*:*:*:*
ciscoios_xe16.6.1cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*
ciscoios_xe16.6.2cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*
ciscoios_xe16.6.3cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*
ciscoios_xe16.7.1cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*
ciscoios_xe16.7.1acpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*
ciscoios_xe16.7.1bcpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*
ciscoios_xe16.8.1cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*
ciscoios_xe16.8.1acpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*
Rows per page:
1-10 of 151

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "3.6.10E"
      },
      {
        "status": "affected",
        "version": "16.1.1"
      },
      {
        "status": "affected",
        "version": "16.1.2"
      },
      {
        "status": "affected",
        "version": "16.1.3"
      },
      {
        "status": "affected",
        "version": "3.2.0JA"
      },
      {
        "status": "affected",
        "version": "16.2.1"
      },
      {
        "status": "affected",
        "version": "16.2.2"
      },
      {
        "status": "affected",
        "version": "16.3.1"
      },
      {
        "status": "affected",
        "version": "16.3.2"
      },
      {
        "status": "affected",
        "version": "16.3.3"
      },
      {
        "status": "affected",
        "version": "16.3.1a"
      },
      {
        "status": "affected",
        "version": "16.3.4"
      },
      {
        "status": "affected",
        "version": "16.3.5"
      },
      {
        "status": "affected",
        "version": "16.3.5b"
      },
      {
        "status": "affected",
        "version": "16.3.6"
      },
      {
        "status": "affected",
        "version": "16.3.7"
      },
      {
        "status": "affected",
        "version": "16.3.8"
      },
      {
        "status": "affected",
        "version": "16.4.1"
      },
      {
        "status": "affected",
        "version": "16.4.2"
      },
      {
        "status": "affected",
        "version": "16.4.3"
      },
      {
        "status": "affected",
        "version": "16.5.1"
      },
      {
        "status": "affected",
        "version": "16.5.1a"
      },
      {
        "status": "affected",
        "version": "16.5.1b"
      },
      {
        "status": "affected",
        "version": "16.5.2"
      },
      {
        "status": "affected",
        "version": "16.5.3"
      },
      {
        "status": "affected",
        "version": "16.6.1"
      },
      {
        "status": "affected",
        "version": "16.6.2"
      },
      {
        "status": "affected",
        "version": "16.6.3"
      },
      {
        "status": "affected",
        "version": "16.7.1"
      },
      {
        "status": "affected",
        "version": "16.7.1a"
      },
      {
        "status": "affected",
        "version": "16.7.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1"
      },
      {
        "status": "affected",
        "version": "16.8.1a"
      },
      {
        "status": "affected",
        "version": "16.8.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1s"
      },
      {
        "status": "affected",
        "version": "16.8.1c"
      },
      {
        "status": "affected",
        "version": "16.8.1d"
      },
      {
        "status": "affected",
        "version": "16.8.1e"
      }
    ]
  }
]

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

53.5%

Related for CVE-2019-1753