CVE-2019-1664
published 2019-02-21CVE-2019-1664: A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.33%
25.5th percentile
A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_hyperflex_hx-series | >= unspecified < 3.5(2a) | 3.5(2a) |
| cisco | hyperflex | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.1HIGHCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jjrr-rj68-xhw3: A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in t
ghsa_unreviewed·2022-05-13
CVE-2019-1664 [HIGH] CWE-287 GHSA-jjrr-rj68-xhw3: A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in t
A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).
Cisco
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
vendor_cisco·2019-02-20·CVSS 8.1
CVE-2019-1664 [HIGH] CWE-287 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster.
The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-chn-root
Cisco
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
CVE-2019-1664: Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. Cisco has released software updates that address this vulnerability. There are
CVSS: 3.0
CWE: CWE-287, CWE-287
Bug IDs: CSCvk31047
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-21
Published