#VU20001 Missing Authentication for Critical Function in Enterprise NFV Infrastructure Software


Published: 2019-08-08

Vulnerability identifier: #VU20001

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1895

CWE-ID: CWE-306

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Enterprise NFV Infrastructure Software
Server applications / Virtualization software

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to access the Virtual Network Computing (VNC) console session of an administrative user on an affected device.

The vulnerability exists due to an insufficient authentication mechanism used to establish a VNC session. A remote attacker can intercept an administrator VNC session request prior to login, watch the administrator console session or interact with it and gain admin access to the affected device.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Enterprise NFV Infrastructure Software: All versions

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfvis-vnc-authbypass

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Missing Authentication for Critical Function in Enterprise NFV Infrastructure Software