PT-2019-14900 · Cisco · Cisco Internet Of Things Field Network Director

Publicado 2019-02-21 · Atualizado 2019-10-09 · CVE-2019-1698

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Internet of Things Field Network Director (IoT-FND) Software versions prior to 4.4(0.26)

Description A vulnerability in the web-based user interface could allow an authenticated, remote attacker to gain read access to information stored on an affected system. This issue is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by importing a crafted XML file with malicious entries, allowing them to read files within the affected application.

Recommendations For versions prior to 4.4(0.26), update to version 4.4(0.26) or later to resolve the issue. As a temporary workaround, consider restricting the import of XML files or limiting access to the web-based user interface to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-1698

Produtos afetados

Cisco Internet Of Things Field Network Director

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-1698 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-iot-fnd-xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1698 · Nota de Segurança
• http://securityfocus.com/bid/107093 · Nota