CVE-2019-1976: Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
First published: Thu Sep 05 2019(Updated: )
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Industrial Network Director | <1.6.0 | |
| Cisco Network Level Service | =1.6\(0.369\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1976?
CVE-2019-1976 is a vulnerability in the "plug-and-play" services component of Cisco Industrial Network Director (IND) that allows an unauthenticated, remote attacker to access sensitive information on an affected device.
How severe is CVE-2019-1976?
CVE-2019-1976 is classified as critical with a severity rating of 9.8 out of 10.
What is the affected software for CVE-2019-1976?
The affected software for CVE-2019-1976 includes Cisco Industrial Network Director versions up to and exclusive to 1.6.0 and Cisco Network Level Service version 1.6 (0.369).
How can an attacker exploit CVE-2019-1976?
An attacker can exploit CVE-2019-1976 by exploiting improper access restrictions on the web-based management interface of the affected devices.
Where can I find more information about CVE-2019-1976?
More information about CVE-2019-1976 can be found in the Cisco Security Advisory at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco industrial network director
- canonical/cisco network level service
- version/cisco network level service/1.6\(0.369\)