PT-2019-3227 · Cisco · Cisco Industrial Network Director

Published 2019-09-04 · Updated 2020-10-16 · CVE-2019-1976

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (IND) (affected versions not specified)

Description A vulnerability in the "plug-and-play" services component of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The issue is due to improper access restrictions on the web-based management interface. An attacker could exploit this by sending a crafted HTTP request to an affected device, potentially allowing access to running configuration information about devices managed by the IND, including administrative credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-03216

CVE-2019-1976

Affected Products

Cisco Industrial Network Director

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1976 · Security Note
• https://bdu.fstec.ru/vul/2019-03216 · Security Note