PT-2025-9692 · Cisco · Cisco Meraki Mx67+1

Published 2025-03-04 · Updated 2025-03-05 · CVE-2019-1815

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Meraki MX67 and MX68 security appliance models (affected versions not specified)

Description A security issue was discovered in the local status page functionality that may allow unauthenticated individuals to access and download logs containing sensitive device information. This is due to improper access control to files holding debugging and maintenance information. The issue is only exploitable when the local status page is enabled on the device. An attacker may obtain access to wireless pre-shared keys, Site-to-Site VPN key, and other sensitive information, potentially allowing administrative-level access to the device.

Recommendations For Cisco Meraki MX67 and MX68 security appliance models, consider disabling the local status page functionality until a fix is available. Restrict access to the device when the local status page is enabled to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-05034

CVE-2019-1815

Affected Products

Cisco Meraki Mx67

Cisco Meraki Mx68

References · 5

• https://bdu.fstec.ru/vul/2025-05034 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1815 · Security Note
• https://t.me/cvenotify/113430 · Telegram Post
• https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability · Note
• https://t.me/cvedetector/19545 · Telegram Post