#VU20431 Use of hard-coded credentials in Cisco Systems, Inc products - CVE-2019-1935

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20431

#VU20431 Use of hard-coded credentials in Cisco Systems, Inc products - CVE-2019-1935

Published: August 28, 2019 / Updated: June 17, 2021


Vulnerability identifier: #VU20431
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2019-1935
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Cisco UCS Director Express for Big Data
Cisco UCS Director
Cisco Integrated Management Controller Supervisor
Software vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. A remote unauthenticated attacker can log in to the CLI of an affected system by using the SCP User account (scpuser) with default user credentials and execute arbitrary commands on the target system. This includes full read and write access to the system's database.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install updates from vendor's website.

External links