cisco-sa-20190904-ind: Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-ind
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20190904-ind?
The severity of cisco-sa-20190904-ind is rated as high due to the potential for unauthorized access to sensitive information.
How do I fix cisco-sa-20190904-ind?
To fix cisco-sa-20190904-ind, ensure you apply the latest software updates provided by Cisco for Industrial Network Director.
What type of attack can exploit cisco-sa-20190904-ind?
cisco-sa-20190904-ind can be exploited by an unauthenticated, remote attacker accessing vulnerable web-based management interfaces.
What component is affected by cisco-sa-20190904-ind?
The vulnerability in cisco-sa-20190904-ind affects the plug-and-play services component of Cisco Industrial Network Director.
Is user authentication required to exploit cisco-sa-20190904-ind?
No, user authentication is not required to exploit the cisco-sa-20190904-ind vulnerability, making it particularly critical.