{"schemaVersion":3,"id":"CVE-2019-1871","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is due to improper bounds checking by the import-config process. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to implement arbitrary code on the affected device with elevated privileges.","dates":{"published":"2019-08-21T18:15:13.566Z","modified":"2024-11-20T17:12:13.465Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":7.2,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":7.2,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03293,"percentile":0.88344,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03293},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03293,"percentile":0.88344}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03293,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03293,"percentile":0.88344}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"cisco","product":"cisco unified computing system (management software)","name":"Cisco Unified Computing System (Management Software)","label":"cisco unified computing system (management software)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 3.0(4k)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 3.0(4k)","eol":null,"hubHref":"/vendor/cisco/cisco_unified_computing_system_management_software"},{"vendor":"cisco","product":"integrated_management_controller_supervisor","name":"integrated management controller supervisor","label":"integrated_management_controller_supervisor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.0.0.0, < 3.0\\(4k\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0.0, < 4.0\\(4b\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.0.0.0, < 3.0\\(4k\\) | ≥ 4.0.0.0, < 4.0\\(4b\\)","eol":null,"hubHref":"/vendor/cisco/integrated_management_controller_supervisor"},{"vendor":"cisco","product":"unified_computing_system","name":"unified computing system","label":"unified_computing_system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.0\\(1c\\)hs3","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0\\(1c\\)hs3","eol":null,"hubHref":"/vendor/cisco/unified_computing_system"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-bo","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-bo","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-08-21T18:15:13.566Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-20T17:12:13.465Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T07:03:13.261Z","stale":false,"partial":false}}