CVE-2019-1966: cisco cisco unified computing system (managed)

Vulnerability summary

CVE-2019-1966 is a high (CVSS 7.8) vulnerability in cisco cisco unified computing system (managed). EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.5% of scored vulnerabilities.

Timeline

1. 29-08-2019
   PublishedVulnerability first disclosed.
2. 20-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to gain elevated privileges as the root user on an affected device. The vulnerability is due to extraneous subcommand options present for a specific CLI command within the local-mgmt context. An attacker could exploit this vulnerability by authenticating to an affected device, entering the local-mgmt context, and issuing a specific CLI command and submitting user input. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid user credentials for the device.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.