CVE-2019-1743 — Improper Input Validation in Cisco IOS XE Software

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal8 documents5 sources
Severity
8.8HIGHNVD
NVD5.3CNA5.3
EPSS
0.7%
top 27.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nokia ImpactCisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 28
Latest updateMay 24

Description

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5cisco/cisco_ios_xe_software31 versions+30
▶NVDcisco/ios_xe31 versions+30
▶NVDnokia/impact< 18a

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-76c7-jr49-pvm9: Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743↗2022-05-24
▶
GHSA
GHSA-vvhx-6jgc-mjr6: A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the fil↗2022-05-13
▶
CVEList
CVE-2019-17406: Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743↗2019-11-25
▶
CVEList
Cisco IOS XE Software Arbitrary File Upload Vulnerability↗2019-03-27
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Arbitrary File Upload Vulnerability↗2019-03-27
▶

💬Community

1
Bugzilla
CVE-2019-15214 kernel: use-after-free in sound/core/init.c and sound/core/info.c↗2019-08-20
▶
CVE-2019-1743 — Improper Input Validation in Cisco | cvebase