CVE-2019-1984: Cisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write Vulnerability
A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1984?
CVE-2019-1984 has been rated as a high severity vulnerability due to the potential impact of file overwriting on the device's operating system.
How do I fix CVE-2019-1984?
To fix CVE-2019-1984, upgrade your Cisco Enterprise Network Functions Virtualization Infrastructure Software to version 3.12.1 or later.
Who is affected by CVE-2019-1984?
Authenticated users with administrator privileges on affected Cisco NFVIS devices are vulnerable to CVE-2019-1984.
What kind of attack can exploit CVE-2019-1984?
CVE-2019-1984 can be exploited by authenticated remote attackers to overwrite files on the underlying operating system of Cisco NFVIS devices.
Is there a workaround for CVE-2019-1984?
Currently, there are no documented workarounds for CVE-2019-1984; the best mitigation is to apply the software update.