Lucene search

CiscoCVE-2019-1880

HistoryJun 05, 2019 - 5:29 p.m.

CVE-2019-1880

2019-06-0517:29:00

CWE-345

cisco

web.nvd.nist.gov

cisco

ucs

c-series

rack servers

bios

vulnerability

firmware

exploit

nvd

cve-2019-1880

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.

Affected configurations

Nvd

Node

ciscounified_computing_system_server_firmwareRange<4.0\(2g\)

AND

ciscounified_computing_system_c125_m5Match-

Node

ciscounified_computing_system_server_firmwareRange<3.0\(4l\)

ciscounified_computing_system_server_firmwareRange4.0–4.0\(2g\)

AND

ciscounified_computing_system_c220_m4Match-

Node

ciscounified_computing_system_server_firmwareRange<4.0\(4c\)

AND

ciscounified_computing_system_c220_m5Match-

Node

ciscounified_computing_system_server_firmwareRange<3.0\(4l\)

ciscounified_computing_system_server_firmwareRange4.0–4.0\(2g\)

AND

ciscounified_computing_system_c240_m4Match-

Node

ciscounified_computing_system_server_firmwareRange<4.0\(4c\)

AND

ciscounified_computing_system_c240_m5Match-

Node

ciscounified_computing_system_server_firmwareRange<3.0\(4l\)

ciscounified_computing_system_server_firmwareRange4.0–4.0\(2g\)

AND

ciscounified_computing_system_c460_m4Match-

Node

ciscounified_computing_system_server_firmwareRange<4.0\(4c\)

AND

ciscounified_computing_system_c480_m5Match-

VendorProductVersionCPE
ciscounified_computing_system_server_firmware*cpe:2.3:o:cisco:unified_computing_system_server_firmware:*:*:*:*:*:*:*:*
ciscounified_computing_system_c125_m5-cpe:2.3:h:cisco:unified_computing_system_c125_m5:-:*:*:*:*:*:*:*
ciscounified_computing_system_c220_m4-cpe:2.3:h:cisco:unified_computing_system_c220_m4:-:*:*:*:*:*:*:*
ciscounified_computing_system_c220_m5-cpe:2.3:h:cisco:unified_computing_system_c220_m5:-:*:*:*:*:*:*:*
ciscounified_computing_system_c240_m4-cpe:2.3:h:cisco:unified_computing_system_c240_m4:-:*:*:*:*:*:*:*
ciscounified_computing_system_c240_m5-cpe:2.3:h:cisco:unified_computing_system_c240_m5:-:*:*:*:*:*:*:*
ciscounified_computing_system_c460_m4-cpe:2.3:h:cisco:unified_computing_system_c460_m4:-:*:*:*:*:*:*:*
ciscounified_computing_system_c480_m5-cpe:2.3:h:cisco:unified_computing_system_c480_m5:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_computing_system_server_firmware	*	cpe:2.3:o:cisco:unified_computing_system_server_firmware::::::::
cisco	unified_computing_system_c125_m5	-	cpe:2.3:h:cisco:unified_computing_system_c125_m5:-:::::::*
cisco	unified_computing_system_c220_m4	-	cpe:2.3:h:cisco:unified_computing_system_c220_m4:-:::::::*
cisco	unified_computing_system_c220_m5	-	cpe:2.3:h:cisco:unified_computing_system_c220_m5:-:::::::*
cisco	unified_computing_system_c240_m4	-	cpe:2.3:h:cisco:unified_computing_system_c240_m4:-:::::::*
cisco	unified_computing_system_c240_m5	-	cpe:2.3:h:cisco:unified_computing_system_c240_m5:-:::::::*
cisco	unified_computing_system_c460_m4	-	cpe:2.3:h:cisco:unified_computing_system_c460_m4:-:::::::*
cisco	unified_computing_system_c480_m5	-	cpe:2.3:h:cisco:unified_computing_system_c480_m5:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Unified Computing System (Managed)",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "4.0(4c)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108680

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ucs-biossig-bypass

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-1880