PT-2019-1536 · Cisco · Cisco Network Convergence System 1000 Series
Published
2019-02-20
·
Updated
2023-03-24
·
CVE-2019-1681
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Network Convergence System 1000 Series software versions prior to Release 6.5.2
Description
A vulnerability in the TFTP service could allow an unauthenticated, remote attacker to retrieve arbitrary files from the targeted device, possibly resulting in information disclosure. The issue is due to improper validation of user-supplied input within TFTP requests. An attacker could exploit this by using directory traversal techniques in malicious requests sent to the TFTP service. This could allow the attacker to retrieve arbitrary files, resulting in the disclosure of sensitive information.
Recommendations
For Cisco Network Convergence System 1000 Series software versions prior to Release 6.5.2, update to Release 6.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the TFTP service until a patch is available. Restrict access to the TFTP service to minimize the risk of exploitation. Avoid using directory traversal techniques in TFTP requests until the issue is resolved.
Fix
Information Disclosure
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Network Convergence System 1000 Series