CiscoCVE-2019-1871CVE-2019-1871
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
50.0%
A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is due to improper bounds checking by the import-config process. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to implement arbitrary code on the affected device with elevated privileges.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cisco | unified_computing_system | 4.0(1c)hs3 | cpe:2.3:a:cisco:unified_computing_system:4.0\(1c\)hs3:*:*:*:*:*:*:* |
| cisco | integrated_management_controller_supervisor | * | cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:* |
| cisco | encs_5100 | - | cpe:2.3:h:cisco:encs_5100:-:*:*:*:*:*:*:* |
| cisco | encs_5400 | - | cpe:2.3:h:cisco:encs_5400:-:*:*:*:*:*:*:* |
| cisco | ucs-e1120d-m3 | - | cpe:2.3:h:cisco:ucs-e1120d-m3:-:*:*:*:*:*:*:* |
| cisco | ucs-e140s-m2 | - | cpe:2.3:h:cisco:ucs-e140s-m2:-:*:*:*:*:*:*:* |
| cisco | ucs-e160d-m2 | - | cpe:2.3:h:cisco:ucs-e160d-m2:-:*:*:*:*:*:*:* |
| cisco | ucs-e160s-m3 | - | cpe:2.3:h:cisco:ucs-e160s-m3:-:*:*:*:*:*:*:* |
| cisco | ucs-e168d-m2 | - | cpe:2.3:h:cisco:ucs-e168d-m2:-:*:*:*:*:*:*:* |
| cisco | ucs-e180d-m3 | - | cpe:2.3:h:cisco:ucs-e180d-m3:-:*:*:*:*:*:*:* |
CNA Affected
[
{
"product": "Cisco Unified Computing System (Management Software)",
"vendor": "Cisco",
"versions": [
{
"lessThan": "3.0(4k)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
50.0%