CVE-2019-1895: Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1895?
CVE-2019-1895 has a medium severity rating.
How do I fix CVE-2019-1895?
To fix CVE-2019-1895, upgrade your Cisco Enterprise NFV Infrastructure Software to a version later than 3.12.1.
Which Cisco products are affected by CVE-2019-1895?
CVE-2019-1895 affects Cisco Enterprise Network Functions Virtualization Infrastructure Software versions prior to 3.12.1.
What is the impact of CVE-2019-1895?
The impact of CVE-2019-1895 is that an unauthenticated remote attacker can access the VNC console session of an administrative user.
Is a configuration change required to mitigate CVE-2019-1895?
No, mitigating CVE-2019-1895 solely requires upgrading the affected software to a secure version.