CVE-2019-1821
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an au…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution2019-05-17 · remote · linux · Verified
- Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit)2019-06-20 · remote · linux · Verified
Impact
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Evolved Programmable Network Manager | before 3.0.1 |
| Cisco | Network Level Service | Version 3.0\(0.0.83b\) |
| Cisco | Prime Infrastructure | before 3.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html
- http://www.securityfocus.com/bid/108339
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce
- http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html
- http://www.securityfocus.com/bid/108339
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce