CVE-2019-1971: Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1971?
CVE-2019-1971 is considered a critical vulnerability due to the potential for unauthorized command execution with root privileges.
How do I fix CVE-2019-1971?
To remediate CVE-2019-1971, upgrade Cisco Enterprise Network Function Virtualization Infrastructure Software to version 3.8.1 or later, or apply any available security patches.
Who is affected by CVE-2019-1971?
CVE-2019-1971 affects installations of Cisco Enterprise Network Function Virtualization Infrastructure Software versions from 3.6.2 to 3.8.1 inclusive.
What type of attack does CVE-2019-1971 allow?
CVE-2019-1971 allows an unauthenticated, remote attacker to perform a command injection attack.
What is the impact of CVE-2019-1971 on affected systems?
The impact of CVE-2019-1971 is the potential execution of arbitrary commands on affected systems, which can compromise system integrity.