CVE-2019-1586
Cisco Application Policy Infrastructure Controller Recoverable Encryption Key Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The vulnerability is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device. An attacker could exploit this vulnerability by retrieving data from the physical disk on the affected partition(s). A successful exploit could allow the attacker to retrieve encryption keys, possibly allowing the attacker to further decrypt other data and sensitive information on the device, which could lead to the disclosure of confidential information.
Una vulnerabilidad en el software Application Policy Infrastructure Controller (APIC) de Cisco, podría permitir que un atacante local no identificado con acceso físico obtenga información confidencial de un dispositivo afectado. La vulnerabilidad es debido a la eliminación no segura de las claves de cifrado de texto no encriptado almacenadas en particiones locales en el disco duro de un dispositivo afectado. Un atacante podría aprovechar esta vulnerabilidad recuperando datos del disco físico en la(s) partición(es) afectada(s). Una operación éxito podría permitir al atacante recuperar claves de cifrado, posiblemente permitiendo que el atacante descifre otros datos e información confidencial en el dispositivo, lo que conllevaría a la revelación de información confidencial.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2018-12-06 CVE Reserved
- 2019-05-03 CVE Published
- 2024-09-23 EPSS Updated
- 2024-11-21 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-320: Key Management Errors
- CWE-459: Incomplete Cleanup
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/108158 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Application Policy Infrastructure Controller Search vendor "Cisco" for product "Application Policy Infrastructure Controller" | 4.1\(0.90a\) Search vendor "Cisco" for product "Application Policy Infrastructure Controller" and version "4.1\(0.90a\)" | - |
Affected
|