// For flags

CVE-2019-1688

Cisco Network Assurance Engine CLI Access with Default Password Vulnerability

Severity Score

7.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault in the password management system of NAE. An attacker could exploit this vulnerability by authenticating with the default administrator password via the CLI of an affected server. A successful exploit could allow the attacker to view potentially sensitive information or bring the server down, causing a DoS condition. This vulnerability affects Cisco Network Assurance Engine (NAE) Release 3.0(1). The default password condition only affects new installations of Release 3.0(1).

Una vulnerabilidad en la interfaz de gestión web de Cisco Network Assurance Engine (NAE) podría permitir que un atacante local no autenticado obtenga acceso no autorizado o provoque una condición de denegación de servicio (DoS) en el servidor. La vulnerabilidad se debe a un error en el sistema de gestión de contraseñas en NAE. Un atacante podría explotar esta vulnerabilidad autenticándose con la contraseña de administrador por defecto mediante la interfaz de línea de comandos de un servidor afectado. Su explotación con éxito podría permitir que el atacante visualice información potencialmente sensible o haga que el servidor se caiga, provocando una denegación de servicio (DoS). La vulnerabilidad afecta a Cisco Network Assurance Engine (NAE) Release 3.0(1). La condición de contraseña por defecto solo afecta a nuevas instalaciones de Release 3.0(1).

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-02-12 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-798: Use of Hard-coded Credentials
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Network Assurance Engine
Search vendor "Cisco" for product "Network Assurance Engine"
 3.0\(1\)
Search vendor "Cisco" for product "Network Assurance Engine" and version "3.0\(1\)"
-
Affected