Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveCiscoCVE-2019-1754
HistoryMar 28, 2019 - 1:29 a.m.

CVE-2019-1754

2019-03-2801:29:00
CWE-269
CWE-20
cisco
web.nvd.nist.gov
56
cisco
ios xe
software
vulnerability
remote code execution
authorization subsystem
cve-2019-1754
nvd

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

Affected configurations

Nvd
Vulners
Node
ciscoios_xeMatch3.2.0ja
OR
ciscoios_xeMatch16.7.1
OR
ciscoios_xeMatch16.7.1a
OR
ciscoios_xeMatch16.7.1b
OR
ciscoios_xeMatch16.8.1
OR
ciscoios_xeMatch16.8.1a
OR
ciscoios_xeMatch16.8.1b
OR
ciscoios_xeMatch16.8.1c
OR
ciscoios_xeMatch16.8.1d
OR
ciscoios_xeMatch16.8.1e
OR
ciscoios_xeMatch16.8.1s
OR
ciscoios_xeMatch16.8.2
OR
ciscoios_xeMatch16.9.1b
OR
ciscoios_xeMatch16.9.1c
OR
ciscoios_xeMatch16.9.1d
OR
ciscoios_xeMatch16.9.1s
VendorProductVersionCPE
ciscoios_xe3.2.0jacpe:2.3:o:cisco:ios_xe:3.2.0ja:*:*:*:*:*:*:*
ciscoios_xe16.7.1cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*
ciscoios_xe16.7.1acpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*
ciscoios_xe16.7.1bcpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*
ciscoios_xe16.8.1cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*
ciscoios_xe16.8.1acpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*
ciscoios_xe16.8.1bcpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*
ciscoios_xe16.8.1ccpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*
ciscoios_xe16.8.1dcpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*
ciscoios_xe16.8.1ecpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*
Rows per page:
1-10 of 161

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "3.2.0JA"
      },
      {
        "status": "affected",
        "version": "16.7.1"
      },
      {
        "status": "affected",
        "version": "16.7.1a"
      },
      {
        "status": "affected",
        "version": "16.7.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1"
      },
      {
        "status": "affected",
        "version": "16.8.1a"
      },
      {
        "status": "affected",
        "version": "16.8.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1s"
      },
      {
        "status": "affected",
        "version": "16.8.1c"
      },
      {
        "status": "affected",
        "version": "16.8.1d"
      },
      {
        "status": "affected",
        "version": "16.8.2"
      },
      {
        "status": "affected",
        "version": "16.8.1e"
      },
      {
        "status": "affected",
        "version": "16.9.1b"
      },
      {
        "status": "affected",
        "version": "16.9.1s"
      },
      {
        "status": "affected",
        "version": "16.9.1c"
      },
      {
        "status": "affected",
        "version": "16.9.1d"
      }
    ]
  }
]

Related

nessus 1
cvelist 1
nvd 1
cisco 1
prion 1
nessus
nessus
Cisco IOS XE Software Privilege Escalation Vulnerability
2019-08-20 00:00:00
cvelist
cvelist
CVE-2019-1754 Cisco IOS XE Software Privilege Escalation Vulnerability
2019-03-28 00:15:28
nvd
nvd
CVE-2019-1754
2019-03-28 01:29:00
cisco
cisco
Cisco IOS XE Software Privilege Escalation Vulnerability
2019-03-27 16:00:00
prion
prion
Input validation
2019-03-28 01:29:00

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON
Related for CVE-2019-1754
nessus1cvelist1nvd1cisco1prion1