PT-2019-4240 · Cisco · Cisco Dna Spaces: Connector+1

Published 2019-11-20 · Updated 2020-10-16 · CVE-2019-15997

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco DNA Spaces: Connector (affected versions not specified) Cisco Digital Network Architecture (DNA) Center (affected versions not specified)

Description The issue is related to insufficient validation of input data, which could allow an authenticated, local attacker to perform a command injection attack. This could enable the attacker to execute arbitrary commands on the underlying operating system as root. The vulnerability can be exploited by including malicious input during the execution of a specific command. A successful exploit could result in the attacker being able to execute arbitrary commands on the underlying operating system as root.

Recommendations For Cisco DNA Spaces: Connector, consider restricting access to the affected CLI command until a patch is available. For Cisco Digital Network Architecture (DNA) Center, restrict the execution of arbitrary code by limiting user privileges and validating user input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-04841

CVE-2019-15997

Affected Products

Cisco Dna Spaces: Connector

Cisco Digital Network Architecture (Dna) Center

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15997 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-cmd-injection · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15997 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04841 · Security Note