Lucene search

CiscoCVE-2019-1839

HistoryAug 21, 2019 - 7:15 p.m.

CVE-2019-1839

2019-08-2119:15:14

CWE-78

CWE-20

cisco

web.nvd.nist.gov

cve-2019-1839

cisco

remote phy

device software

vulnerability

command execution

root privilege

linux shell

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.2%

JSON

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying various CLI commands with crafted arguments. A successful exploit could allow the attacker to run arbitrary commands as the root user, allowing complete compromise of the system.

Affected configurations

Nvd

Node

ciscoremote_phy_120_firmwareRange<6.4

AND

ciscoremote_phy_120Match-

Node

ciscoremote_phy_220_firmwareRange<3.1

AND

ciscoremote_phy_220Match-

Node

ciscoremote_phy_shelf_7200_firmwareRange<1.2

AND

ciscoremote_phy_shelf_7200Match-

Node

ciscocbr-8_firmwareMatch1.1

ciscocbr-8_firmwareMatch6.1

ciscocbr-8_firmwareMatch6.2

AND

ciscocbr-8Match-

VendorProductVersionCPE
ciscoremote_phy_120_firmware*cpe:2.3:o:cisco:remote_phy_120_firmware:*:*:*:*:*:*:*:*
ciscoremote_phy_120-cpe:2.3:h:cisco:remote_phy_120:-:*:*:*:*:*:*:*
ciscoremote_phy_220_firmware*cpe:2.3:o:cisco:remote_phy_220_firmware:*:*:*:*:*:*:*:*
ciscoremote_phy_220-cpe:2.3:h:cisco:remote_phy_220:-:*:*:*:*:*:*:*
ciscoremote_phy_shelf_7200_firmware*cpe:2.3:o:cisco:remote_phy_shelf_7200_firmware:*:*:*:*:*:*:*:*
ciscoremote_phy_shelf_7200-cpe:2.3:h:cisco:remote_phy_shelf_7200:-:*:*:*:*:*:*:*
ciscocbr-8_firmware1.1cpe:2.3:o:cisco:cbr-8_firmware:1.1:*:*:*:*:*:*:*
ciscocbr-8_firmware6.1cpe:2.3:o:cisco:cbr-8_firmware:6.1:*:*:*:*:*:*:*
ciscocbr-8_firmware6.2cpe:2.3:o:cisco:cbr-8_firmware:6.2:*:*:*:*:*:*:*
ciscocbr-8-cpe:2.3:h:cisco:cbr-8:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	remote_phy_120_firmware	*	cpe:2.3:o:cisco:remote_phy_120_firmware::::::::
cisco	remote_phy_120	-	cpe:2.3:h:cisco:remote_phy_120:-:::::::*
cisco	remote_phy_220_firmware	*	cpe:2.3:o:cisco:remote_phy_220_firmware::::::::
cisco	remote_phy_220	-	cpe:2.3:h:cisco:remote_phy_220:-:::::::*
cisco	remote_phy_shelf_7200_firmware	*	cpe:2.3:o:cisco:remote_phy_shelf_7200_firmware::::::::
cisco	remote_phy_shelf_7200	-	cpe:2.3:h:cisco:remote_phy_shelf_7200:-:::::::*
cisco	cbr-8_firmware	1.1	cpe:2.3:o:cisco:cbr-8_firmware:1.1:::::::*
cisco	cbr-8_firmware	6.1	cpe:2.3:o:cisco:cbr-8_firmware:6.1:::::::*
cisco	cbr-8_firmware	6.2	cpe:2.3:o:cisco:cbr-8_firmware:6.2:::::::*
cisco	cbr-8	-	cpe:2.3:h:cisco:cbr-8:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Remote PHY",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-rphy

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.2%

JSON

Related for CVE-2019-1839