PT-2019-3076 · Cisco · Cisco Remote Phy Device

Publicado 2019-08-21 · Atualizado 2020-10-16 · CVE-2019-1839

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Remote PHY Device Software (affected versions not specified)

Description The issue is related to insufficient input validation, which could allow an attacker to execute arbitrary commands on the underlying Linux shell with root privileges. This can be achieved by supplying crafted arguments to various CLI commands. A successful exploit could lead to complete system compromise.

Recommendations For Cisco Remote PHY Device Software, consider restricting access to the CLI to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted arguments in CLI commands to reduce the risk of arbitrary command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

BDU:2019-03058

CVE-2019-1839

Produtos afetados

Cisco Remote Phy Device

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-1839 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-rphy · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1839 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03058 · Nota de Segurança