PT-2019-2063 · Cisco · Cisco Ftd

Lubomir Vesely · Published 2019-05-01 · Updated 2024-11-26 · CVE-2019-1699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense Software (affected versions not specified)

Description The issue exists due to insufficient input validation in the command-line interface of the software, allowing an attacker to perform a command injection attack. This could enable the execution of arbitrary code with root privileges. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For all affected versions, consider restricting access to the command-line interface to minimize the risk of exploitation. As a temporary workaround, avoid using arguments that could be used for command injection in specific commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-01808

CVE-2019-1699

Affected Products

Cisco Ftd

References · 6

• https://bdu.fstec.ru/vul/2019-01808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1699 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-ftd-cmd-inject · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1699 · Vendor Advisory
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Note