PT-2019-2344 · Cisco · Cisco Industrial Network Director

Publicado 2019-06-05 · Atualizado 2020-10-16 · CVE-2019-1861

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (affected versions not specified)

Description The issue is related to insufficient input validation in the software update feature. This could allow a remote attacker to execute arbitrary code by uploading a specially crafted file. The attacker must have administrator privileges to exploit this issue. The vulnerability is due to improper validation of uploaded files.

Recommendations For all affected versions, consider restricting access to the software update feature until a fix is available. As a temporary workaround, restrict file uploads to only necessary and trusted sources. Avoid using administrator privileges for routine operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-20

CWE-434

Identificadores relacionados

BDU:2019-02119

CVE-2019-1861

Produtos afetados

Cisco Industrial Network Director

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-1861 · Aviso do Fabricante
• http://securityfocus.com/bid/108622 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ind-rce · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02119 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1861 · Nota de Segurança
• https://securityfocus.com/bid/108622 · Nota