HIGH · 7.2

CVE-2019-1885

A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on a...

Vulnerability Description

A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by sending crafted authenticated commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary commands on an affected device with root privileges.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoUnified Computing System4.0\(1c\)hs3
CiscoIntegrated Management Controller Supervisor>= 3.0.0.0, < 3.0\(4k\)
CiscoUcs C125 M5-
CiscoUcs C4200-
CiscoUcs S3260-

Related Weaknesses (CWE)

References

FAQ

What is CVE-2019-1885?

CVE-2019-1885 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on a...

How severe is CVE-2019-1885?

CVE-2019-1885 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-1885?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Unified Computing System, Cisco Integrated Management Controller Supervisor, Cisco Ucs C125 M5, Cisco Ucs C4200, Cisco Ucs S3260.