PT-2019-14900 · Cisco · Cisco Internet Of Things Field Network Director

Published 2019-02-21 · Updated 2019-10-09 · CVE-2019-1698

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Internet of Things Field Network Director (IoT-FND) Software versions prior to 4.4(0.26)

Description A vulnerability in the web-based user interface could allow an authenticated, remote attacker to gain read access to information stored on an affected system. This issue is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by importing a crafted XML file with malicious entries, allowing them to read files within the affected application.

Recommendations For versions prior to 4.4(0.26), update to version 4.4(0.26) or later to resolve the issue. As a temporary workaround, consider restricting the import of XML files or limiting access to the web-based user interface to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-1698

Affected Products

Cisco Internet Of Things Field Network Director

References · 4

• https://osv.dev/vulnerability/CVE-2019-1698 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-iot-fnd-xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1698 · Security Note
• http://securityfocus.com/bid/107093 · Note