PT-2019-1535 · Cisco · Cisco Network Assurance Engine

Published 2019-02-12 · Updated 2023-03-23 · CVE-2019-1688

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Network Assurance Engine (NAE) Release 3.0(1)

Description A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The issue is due to a fault in the password management system of NAE, specifically related to the use of default administrator credentials. An attacker could exploit this by authenticating with the default administrator password via the CLI of an affected server, potentially allowing them to view sensitive information or bring the server down.

Recommendations For Cisco Network Assurance Engine (NAE) Release 3.0(1), change the default administrator password as soon as possible after installation to prevent unauthorized access. Consider restricting access to the management web interface and CLI until the password is changed. As a temporary workaround, limit the use of the default administrator account until a secure password is set.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2019-01034

CVE-2019-1688

Affected Products

Cisco Network Assurance Engine

References · 5

• https://bdu.fstec.ru/vul/2019-01034 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1688 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1688 · Security Note
• http://securityfocus.com/bid/107010 · Note