CVE-2019-1675: cisco aironet_active_sensor Use of Hard-coded Credentials
Vulnerability summary
CVE-2019-1675 is a high (CVSS 7.8) Use of Hard-coded Credentials vulnerability in cisco aironet_active_sensor. EPSS estimates a 2.59% chance of exploitation in the next 30 days, higher than 85% of scored vulnerabilities.
Timeline
- 07-02-2019PublishedVulnerability first disclosed.
- 19-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker could exploit this vulnerability by guessing the account name and password to access the CLI. A successful exploit could allow the attacker to reboot the device repeatedly, creating a denial of service (DoS) condition. It is not possible to change the configuration or view sensitive data with this account. Versions prior to DNAC1.2.8 are affected.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.59%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.59% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco3 products
- aironet_active_sensorna
- cisco aironet active sensor≥ unspecified, < DNAC1.2.8
- digital_network_architecture_center< 1.2.8
1 vendor · 3 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-aas-credsVendor AdvisoryX Refsource CISCO