PT-2019-3227 · Cisco · Cisco Industrial Network Director

Publicado 2019-09-04 · Atualizado 2020-10-16 · CVE-2019-1976

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (IND) (affected versions not specified)

Description A vulnerability in the "plug-and-play" services component of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The issue is due to improper access restrictions on the web-based management interface. An attacker could exploit this by sending a crafted HTTP request to an affected device, potentially allowing access to running configuration information about devices managed by the IND, including administrative credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2019-03216

CVE-2019-1976

Produtos afetados

Cisco Industrial Network Director

Referências · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1976 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1976 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03216 · Nota de Segurança