Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveCiscoCVE-2019-1935
HistoryAug 21, 2019 - 7:15 p.m.

CVE-2019-1935

2019-08-2119:15:15
CWE-798
cisco
web.nvd.nist.gov
97
20
cisco
integrated management controller
imc
supervisor
ucs director
ucs director express
big data
vulnerability
remote access
default credentials
nvd

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.942

Percentile

99.2%

JSON

A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system’s database.

Affected configurations

Nvd
Vulners
Node
ciscointegrated_management_controller_supervisorRange2.2.0.0–2.2.0.6
OR
ciscointegrated_management_controller_supervisorMatch2.1.0.0
Node
ciscoucs_directorMatch6.0.0.0
OR
ciscoucs_directorMatch6.5.0.0
OR
ciscoucs_directorMatch6.6.0.0
OR
ciscoucs_directorMatch6.6.1.0
OR
ciscoucs_directorMatch6.7\(0.0.67265\)
OR
ciscoucs_directorMatch6.7.0.0
OR
ciscoucs_directorMatch6.7.1.0
Node
ciscoucs_director_express_for_big_dataMatch3.0.0.0
OR
ciscoucs_director_express_for_big_dataMatch3.5.0.0
OR
ciscoucs_director_express_for_big_dataMatch3.6.0.0
OR
ciscoucs_director_express_for_big_dataMatch3.7.0.0
OR
ciscoucs_director_express_for_big_dataMatch3.7.1.0
VendorProductVersionCPE
ciscointegrated_management_controller_supervisor*cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*
ciscointegrated_management_controller_supervisor2.1.0.0cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1.0.0:*:*:*:*:*:*:*
ciscoucs_director6.0.0.0cpe:2.3:a:cisco:ucs_director:6.0.0.0:*:*:*:*:*:*:*
ciscoucs_director6.5.0.0cpe:2.3:a:cisco:ucs_director:6.5.0.0:*:*:*:*:*:*:*
ciscoucs_director6.6.0.0cpe:2.3:a:cisco:ucs_director:6.6.0.0:*:*:*:*:*:*:*
ciscoucs_director6.6.1.0cpe:2.3:a:cisco:ucs_director:6.6.1.0:*:*:*:*:*:*:*
ciscoucs_director6.7(0.0.67265)cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:*
ciscoucs_director6.7.0.0cpe:2.3:a:cisco:ucs_director:6.7.0.0:*:*:*:*:*:*:*
ciscoucs_director6.7.1.0cpe:2.3:a:cisco:ucs_director:6.7.1.0:*:*:*:*:*:*:*
ciscoucs_director_express_for_big_data3.0.0.0cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.0.0.0:*:*:*:*:*:*:*
Rows per page:
1-10 of 141

CNA Affected

[
  {
    "product": "Cisco Unified Computing System Director",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.7.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

Related

cvelist 1
cisco 1
metasploit 1
nessus 1
prion 1
packetstorm 2
nvd 1
exploitdb 2
zdt 2
exploitpack 1
threatpost 1
cvelist
cvelist
CVE-2019-1935 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
2019-08-21 18:25:23
cisco
cisco
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
2019-08-21 16:00:00
metasploit
metasploit
Cisco UCS Director default scpuser password
2019-08-28 04:00:08
nessus
nessus
Cisco UCS Director SCP User Default Credentials (cisco-sa-20190821-imcs-usercred)
2019-12-11 00:00:00
prion
prion
Default credentials
2019-08-21 19:15:00
packetstorm
packetstorm
Cisco UCS Director Default scpuser Password
2019-09-02 00:00:00
Cisco UCS / IMC Supervisor Authentication Bypass / Command Injection
2019-08-28 00:00:00
nvd
nvd
CVE-2019-1935
2019-08-21 19:15:15
exploitdb
exploitdb
Cisco UCS Director - default scpuser password (Metasploit)
2019-09-03 00:00:00
Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
2019-08-21 00:00:00
zdt
zdt
Cisco UCS Director Default scpuser Password Exploit
2019-09-02 00:00:00
Cisco UCS Director, Cisco Integrated Management Controller Supervisor - Multiple Vulnerabilities
2019-08-29 00:00:00
exploitpack
exploitpack
Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
2019-08-21 00:00:00
threatpost
threatpost
Cisco Patches Six Critical Bugs in UCS Gear and Switches
2019-08-21 17:38:24

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.942

Percentile

99.2%

JSON
Related for CVE-2019-1935
cvelist1cisco1metasploit1nessus1prion1packetstorm2nvd1exploitdb2zdt2exploitpack1threatpost1