PT-2019-3076 · Cisco · Cisco Remote Phy Device

Published 2019-08-21 · Updated 2020-10-16 · CVE-2019-1839

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Remote PHY Device Software (affected versions not specified)

Description The issue is related to insufficient input validation, which could allow an attacker to execute arbitrary commands on the underlying Linux shell with root privileges. This can be achieved by supplying crafted arguments to various CLI commands. A successful exploit could lead to complete system compromise.

Recommendations For Cisco Remote PHY Device Software, consider restricting access to the CLI to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted arguments in CLI commands to reduce the risk of arbitrary command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-03058

CVE-2019-1839

Affected Products

Cisco Remote Phy Device

References · 4

• https://osv.dev/vulnerability/CVE-2019-1839 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-rphy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1839 · Security Note
• https://bdu.fstec.ru/vul/2019-03058 · Security Note