CVE-2019-1976: Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1976?
CVE-2019-1976 is a vulnerability in the "plug-and-play" services component of Cisco Industrial Network Director (IND) that allows an unauthenticated, remote attacker to access sensitive information on an affected device.
How severe is CVE-2019-1976?
CVE-2019-1976 is classified as critical with a severity rating of 9.8 out of 10.
What is the affected software for CVE-2019-1976?
The affected software for CVE-2019-1976 includes Cisco Industrial Network Director versions up to and exclusive to 1.6.0 and Cisco Network Level Service version 1.6 (0.369).
How can an attacker exploit CVE-2019-1976?
An attacker can exploit CVE-2019-1976 by exploiting improper access restrictions on the web-based management interface of the affected devices.
Where can I find more information about CVE-2019-1976?
More information about CVE-2019-1976 can be found in the Cisco Security Advisory at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind.