PT-2019-2792 · Cisco · Cisco Industrial Network Director
Publicado
2019-07-17
·
Atualizado
2021-10-29
·
CVE-2019-1940
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Industrial Network Director versions prior to 1.7
Description
A vulnerability in the Web Services Management Agent (WSMA) feature could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid X.509 certificate. The issue is due to insufficient X.509 certificate validation when establishing a WSMA connection. An attacker could exploit this by supplying a crafted X.509 certificate during the WSMA connection setup phase, potentially allowing them to conduct man-in-the-middle attacks to decrypt confidential information on WSMA connections.
Recommendations
For versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting WSMA connections to trusted sources or implementing additional validation for X.509 certificates to minimize the risk of exploitation.
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Industrial Network Director