PT-2019-2549 · Cisco · Cisco Integrated Management Controller

Published 2019-06-19 · Updated 2020-10-06 · CVE-2019-1627

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller (IMC) (affected versions not specified)

Description A vulnerability exists due to insufficient protection of data in the configuration file, allowing an authenticated, remote attacker to gain unauthorized access to sensitive user information. The attacker could exploit this by downloading the configuration file, potentially using the sensitive information to elevate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Cleartext Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-78

CWE-312

CWE-200

Related Identifiers

BDU:2019-02401

CVE-2019-1627

Affected Products

Cisco Integrated Management Controller

References · 7

• https://bdu.fstec.ru/vul/2019-02401 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1627 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-infodiscl · Vendor Advisory
• http://securityfocus.com/bid/108847 · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note