Lucene search

CiscoCVE-2019-1950

HistoryFeb 19, 2020 - 8:15 p.m.

CVE-2019-1950

2020-02-1920:15:14

CWE-1188

CWE-255

cisco

web.nvd.nist.gov

cisco

ios xe

sd-wan

vulnerability

unauthorized access

nvd

cve-2019-1950

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.

Affected configurations

Nvd

Node

ciscoios_xeRange≤16.11

AND

cisco1100-4p_integrated_services_routerMatch-

cisco1100-8p_integrated_services_routerMatch-

cisco1101-4p_integrated_services_routerMatch-

cisco1109-2p_integrated_services_routerMatch-

cisco1109-4p_integrated_services_routerMatch-

cisco1111x-8p_integrated_services_routerMatch-

cisco4221_integrated_services_routerMatch-

cisco4331_integrated_services_routerMatch-

cisco4431_integrated_services_routerMatch-

cisco4461_integrated_services_routerMatch-

ciscoasr_1000-xMatch-

ciscoasr_1001-hxMatch-

ciscoasr_1002-hxMatch-

ciscoasr_1002-xMatch-

ciscoasr_1004Match-

ciscoasr_1006Match-

ciscoasr_1006-xMatch-

ciscoasr_1009-xMatch-

ciscoasr_1013Match-

ciscocsr1000vMatch-

ciscoir1101Match-

cisconexus_56128pMatch-

cisconexus_5624qMatch-

cisconexus_5648qMatch-

cisconexus_5672upMatch-

cisconexus_5672up-16gMatch-

cisconexus_5696qMatch-

ciscoucs-e1120d-m3Match-

ciscoucs-e140s-m2Match-

ciscoucs-e160d-m2Match-

ciscoucs-e160s-m3Match-

ciscoucs-e180d-m2Match-

ciscoucs-e180d-m3Match-

VendorProductVersionCPE
ciscoios_xe*cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
cisco1100-4p_integrated_services_router-cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-8p_integrated_services_router-cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1101-4p_integrated_services_router-cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1109-2p_integrated_services_router-cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1109-4p_integrated_services_router-cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1111x-8p_integrated_services_router-cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*
cisco4221_integrated_services_router-cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*
cisco4331_integrated_services_router-cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*
cisco4431_integrated_services_router-cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	*	cpe:2.3:o:cisco:ios_xe::::::::
cisco	1100-4p_integrated_services_router	-	cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:::::::*
cisco	1100-8p_integrated_services_router	-	cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:::::::*
cisco	1101-4p_integrated_services_router	-	cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:::::::*
cisco	1109-2p_integrated_services_router	-	cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:::::::*
cisco	1109-4p_integrated_services_router	-	cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:::::::*
cisco	1111x-8p_integrated_services_router	-	cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:::::::*
cisco	4221_integrated_services_router	-	cpe:2.3:h:cisco:4221_integrated_services_router:-:::::::*
cisco	4331_integrated_services_router	-	cpe:2.3:h:cisco:4331_integrated_services_router:-:::::::*
cisco	4431_integrated_services_router	-	cpe:2.3:h:cisco:4431_integrated_services_router:-:::::::*

Rows per page:

1-10 of 341

CNA Affected

[
  {
    "product": "Cisco IOS XE SD-WAN Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "16.11 and earlier"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Related for CVE-2019-1950