CVE-2019-1736

CWE-3474 documents4 sources

Severity

6.6MEDIUM

EPSS

0.0%

top 90.51%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Fmc1000-k9 Bios Cisco Fmc1000-k9 Firmware Cisco Fmc2500-k9 Bios +20 more

Timeline

PublishedSep 23

Latest updateMay 24

Description

A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A su…

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 0.7 | Impact: 5.9

Affected Packages23 packages

▶NVDcisco/tg5004-k9_firmware< 4.0.2h

▶NVDcisco/fmc1000-k9_firmware< 4.0.2h

▶NVDcisco/fmc2500-k9_firmware< 4.0.2h

▶NVDcisco/fmc4500-k9_firmware< 4.0.2h

▶NVDcisco/sns-3515-k9_firmware< 4.0.2h

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

GHSA

GHSA-pwvv-633w-65j9: A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Fi↗2022-05-24

▶

CVEList

Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability↗2020-09-23

▶

📋Vendor Advisories

Cisco

Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability↗2020-02-19

▶