PT-2019-2365 · Cisco · Cisco Unified Computing System (Ucs) C-Series Rack Servers

Published 2019-06-05 · Updated 2019-10-09 · CVE-2019-1880

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System (UCS) C-Series Rack Servers (affected versions not specified)

Description A vulnerability in the BIOS upgrade utility could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The issue is due to insufficient validation of the firmware image file. An attacker could exploit this by executing the BIOS upgrade utility with specific options, potentially bypassing the firmware signature-verification process and installing compromised BIOS firmware.

Recommendations For Cisco Unified Computing System (UCS) C-Series Rack Servers, consider restricting access to the BIOS upgrade utility until a fix is available. As a temporary workaround, avoid using the BIOS upgrade utility with unverified firmware image files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2019-02140

CVE-2019-1880

Affected Products

Cisco Unified Computing System (Ucs) C-Series Rack Servers

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1880 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ucs-biossig-bypass · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1880 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02140 · Security Note
• https://securityfocus.com/bid/108680 · Note
• http://securityfocus.com/bid/108680 · Note