PT-2019-3071 · Cisco · Cisco Integrated Management Controller

Published 2019-08-21 · Updated 2020-10-16 · CVE-2019-1634

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller (IMC) (affected versions not specified)

Description A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The issue is due to insufficient input validation of user-supplied commands. An attacker with administrator privileges and access to the network where the IPMI resides could exploit this by submitting crafted input to the affected commands, potentially gaining root privileges on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-03053

CVE-2019-1634

Affected Products

Cisco Integrated Management Controller

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-cmdinject-1634 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1634 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03053 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1634 · Security Note