CVE-2019-1688: cisco cisco network assurance engine Use of Hard-coded Credentials

Vulnerability summary

CVE-2019-1688 is a high (CVSS 7.7) Use of Hard-coded Credentials vulnerability in cisco cisco network assurance engine. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.1% of scored vulnerabilities.

Timeline

1. 12-02-2019
   PublishedVulnerability first disclosed.
2. 21-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault in the password management system of NAE. An attacker could exploit this vulnerability by authenticating with the default administrator password via the CLI of an affected server. A successful exploit could allow the attacker to view potentially sensitive information or bring the server down, causing a DoS condition. This vulnerability affects Cisco Network Assurance Engine (NAE) Release 3.0(1). The default password condition only affects new installations of Release 3.0(1).

• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.