PT-2019-2063 · Cisco · Cisco Ftd

Lubomir Vesely · Publicado 2019-05-01 · Atualizado 2024-11-26 · CVE-2019-1699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense Software (affected versions not specified)

Description The issue exists due to insufficient input validation in the command-line interface of the software, allowing an attacker to perform a command injection attack. This could enable the execution of arbitrary code with root privileges. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For all affected versions, consider restricting access to the command-line interface to minimize the risk of exploitation. As a temporary workaround, avoid using arguments that could be used for command injection in specific commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2019-01808

CVE-2019-1699

Produtos afetados

Cisco Ftd

Referências · 6

• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Nota
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Nota
• https://bdu.fstec.ru/vul/2019-01808 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1699 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-ftd-cmd-inject · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1699 · Aviso do Fabricante