// For flags

CVE-2019-1894

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read and Write Vulnerability

Severity Score

7.2
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in NFVIS filesystem commands. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite or read arbitrary files on the underlying OS.

Una vulnerabilidad en Enterprise NFV Infrastructure Software (NFVIS) de Cisco, podría permitir a un atacante remoto identificado con privilegios de administrador sobrescribir o leer archivos arbitrarios en el sistema operativo subyacente (OS) de un dispositivo afectado. La vulnerabilidad es debido a una comprobación de entrada inapropiada en los comandos del sistema de archivos de NFVIS. Un atacante podría aprovechar esta vulnerabilidad mediante el uso de variables especialmente diseñadas durante la ejecución de un comando afectado. Un ataque con éxito podría permitir al atacante sobrescribir o leer archivos arbitrarios en el sistema operativo subyacente.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-07-06 CVE Published
  • 2023-08-14 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Enterprise Nfv Infrastructure Software
Search vendor "Cisco" for product "Enterprise Nfv Infrastructure Software"
 3.9.1
Search vendor "Cisco" for product "Enterprise Nfv Infrastructure Software" and version "3.9.1"
-
Affected