PT-2019-2128 · Cisco · Cisco Ucs B-Series Blade Servers

Published 2019-04-17 · Updated 2020-10-08 · CVE-2019-1725

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco UCS B-Series Blade Servers versions prior to 4.0(2a)

Description The issue is related to insufficient input validation in the local management CLI implementation, allowing an authenticated, local attacker to overwrite arbitrary files on disk or inject CLI command parameters that should not be allowed. This can be achieved by issuing crafted forms of a limited subset of local management CLI commands.

Recommendations For versions prior to 4.0(2a), update to software version 4.0(2a) or later to resolve the issue. As a temporary workaround, consider restricting access to the local management CLI to minimize the risk of exploitation. Avoid using the vulnerable CLI commands until the issue is resolved.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-01889

CVE-2019-1725

Affected Products

Cisco Ucs B-Series Blade Servers

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ucs-cli-inj · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01889 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1725 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1725 · Vendor Advisory
• http://securityfocus.com/bid/108082 · Note