PT-2019-3965 · Cisco · Cisco Evolved Programmable Network Manager+1

Published 2019-11-06 · Updated 2020-10-22 · CVE-2019-15958

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) (affected versions not specified)

Description A vulnerability in the REST API of the affected systems could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The issue is due to insufficient input validation during the initial High Availability (HA) configuration and registration process of an affected device. An attacker could exploit this by uploading a malicious file during the HA registration period, potentially allowing the execution of arbitrary code with root-level privileges. This vulnerability can only be exploited during the HA registration period.

Recommendations For Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM), as a temporary workaround, consider restricting access to the REST API during the HA registration period to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-04496

CVE-2019-15958

Affected Products

Cisco Evolved Programmable Network Manager

Cisco Prime Infrastructure

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15958 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-pi-epn-codex · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04496 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15958 · Vendor Advisory