PT-2019-4241 · Cisco · Cisco Dna Spaces: Connector+1

Published 2019-11-20 · Updated 2020-10-16 · CVE-2019-15996

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco DNA Spaces: Connector (affected versions not specified) Cisco Digital Network Architecture (DNA) Center (affected versions not specified)

Description The issue is related to insufficient restrictions during the execution of a CLI command, allowing an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This could be achieved by modifying sensitive files, leveraging the insufficient restrictions. A successful exploit could result in the attacker gaining the ability to execute arbitrary commands on the system.

Recommendations For Cisco DNA Spaces: Connector, consider restricting access to the affected CLI command until a fix is available. For Cisco Digital Network Architecture (DNA) Center, restrict privilege management to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Improper Privilege Management

Weakness Enumeration

CWE-78

CWE-264

CWE-269

Related Identifiers

BDU:2019-04842

CVE-2019-15996

Affected Products

Cisco Dna Spaces: Connector

Cisco Digital Network Architecture (Dna) Center

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-priv-esca · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15996 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15996 · Security Note
• https://bdu.fstec.ru/vul/2019-04842 · Security Note