PT-2019-2128 · Cisco · Cisco Ucs B-Series Blade Servers

Publicado 2019-04-17 · Atualizado 2020-10-08 · CVE-2019-1725

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco UCS B-Series Blade Servers versions prior to 4.0(2a)

Description The issue is related to insufficient input validation in the local management CLI implementation, allowing an authenticated, local attacker to overwrite arbitrary files on disk or inject CLI command parameters that should not be allowed. This can be achieved by issuing crafted forms of a limited subset of local management CLI commands.

Recommendations For versions prior to 4.0(2a), update to software version 4.0(2a) or later to resolve the issue. As a temporary workaround, consider restricting access to the local management CLI to minimize the risk of exploitation. Avoid using the vulnerable CLI commands until the issue is resolved.

Correção

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

BDU:2019-01889

CVE-2019-1725

Produtos afetados

Cisco Ucs B-Series Blade Servers

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ucs-cli-inj · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01889 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1725 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1725 · Aviso do Fabricante
• http://securityfocus.com/bid/108082 · Nota