Vulnerabilities > CVE-2019-1907 - Unspecified vulnerability in Cisco products

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

cisco

NVD

Published: 2019-08-21

Updated: 2024-11-21

Summary

A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker with read-only privileges to gain administrator privileges.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Unified Computing System 4.0\(1C\)Hs3 Cisco Integrated Management Controller Supervisor 1.0.0.0 Cisco Integrated Management Controller Supervisor 1.0.0.1 Cisco Integrated Management Controller Supervisor 1.1.0.0 Cisco Integrated Management Controller Supervisor 1.5\(1B\) Cisco Integrated Management Controller Supervisor 1.5\(1F\) Cisco Integrated Management Controller Supervisor 1.5\(1J\) Cisco Integrated Management Controller Supervisor 1.5\(1K\) Cisco Integrated Management Controller Supervisor 1.5\(1L\) Cisco Integrated Management Controller Supervisor 1.5\(2\) Cisco Integrated Management Controller Supervisor 1.5\(2\)3 Cisco Integrated Management Controller Supervisor 1.5\(3D\) Cisco Integrated Management Controller Supervisor 1.5\(3G\) Cisco Integrated Management Controller Supervisor 1.5\(3H\)1 Cisco Integrated Management Controller Supervisor 1.5\(4\)3 Cisco Integrated Management Controller Supervisor 1.5\(4G\) Cisco Integrated Management Controller Supervisor 1.5\(5\) Cisco Integrated Management Controller Supervisor 1.5\(7A\)2 Cisco Integrated Management Controller Supervisor 1.5\(7C\)2 Cisco Integrated Management Controller Supervisor 1.5\(7E\) Cisco Integrated Management Controller Supervisor 1.5\(7F\) Cisco Integrated Management Controller Supervisor 1.5\(9G\) Cisco Integrated Management Controller Supervisor 1.5.0.0 Cisco Integrated Management Controller Supervisor 2.0\(13O\) Cisco Integrated Management Controller Supervisor 2.0.0.0 Cisco Integrated Management Controller Supervisor 2.1\(0.0\) Cisco Integrated Management Controller Supervisor 2.1\(0.2\) Cisco Integrated Management Controller Supervisor 2.1.0.0 Cisco Integrated Management Controller Supervisor 2.1.0.1 Cisco Integrated Management Controller Supervisor 2.1.0.2 Cisco Integrated Management Controller Supervisor 2.2\(0.2\) Cisco Integrated Management Controller Supervisor 2.2.0.0 Cisco Integrated Management Controller Supervisor 2.2.0.1 Cisco Integrated Management Controller Supervisor 2.2.0.2 Cisco Integrated Management Controller Supervisor 2.2.0.3 Cisco Integrated Management Controller Supervisor 2.2.0.4 Cisco Integrated Management Controller Supervisor 2.2.0.5 Cisco Integrated Management Controller Supervisor 2.2.0.6 Cisco Integrated Management Controller Supervisor 2.2.1.0 Cisco Integrated Management Controller Supervisor 2.2.1.3 Cisco Integrated Management Controller Supervisor 3.0\(1C\) Cisco Integrated Management Controller Supervisor 3.0\(4K\) Cisco Integrated Management Controller Supervisor 3.0.0.0 Cisco Integrated Management Controller Supervisor 4.0\(1A\) Cisco Integrated Management Controller Supervisor 4.0\(1B\) Cisco Integrated Management Controller Supervisor 4.0\(1C\) Cisco Integrated Management Controller Supervisor 4.0\(1D\) Cisco Integrated Management Controller Supervisor 4.0\(2C\) Cisco Integrated Management Controller Supervisor 4.0\(2F\)	49
Hardware	Cisco Cisco UCS C125 M5 - Cisco UCS C4200 - Cisco UCS S3260 -	3

Summary

Vulnerable Configurations

References