CVE-2019-1883: Cisco Integrated Management Controller CLI Command Injection Vulnerability
A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input on the command-line interface. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow an attacker to execute arbitrary commands on the device with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1883?
CVE-2019-1883 is a vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) that could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands and obtain root privileges.
How severe is CVE-2019-1883?
CVE-2019-1883 has a severity rating of 7.8 (high).
Which software products are affected by CVE-2019-1883?
The affected software products include Cisco Unified Computing System, Cisco Integrated Management Controller Supervisor, Cisco Encs 5100, Cisco Encs 5400, Cisco Ucs-e1120d-m3, Cisco Ucs-e140s-m2, Cisco Ucs-e160d-m2, Cisco Ucs-e160s-m3, Cisco Ucs-e168d-m2, Cisco Ucs-e180d-m3, Cisco Ucs C125 M5, Cisco Ucs C4200, and Cisco Ucs S3260.
How can an attacker exploit CVE-2019-1883?
An attacker with read-only credentials can inject arbitrary commands through the command-line interface of Cisco Integrated Management Controller (IMC), allowing them to obtain root privileges.
Where can I find more information about CVE-2019-1883?
You can find more information about CVE-2019-1883 on the Cisco website: [https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-cimc-cli-inject](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-cimc-cli-inject)