CVE-2019-1984

published 2019-08-21

CVE-2019-1984: A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with…

Priority P3 40 medium 6.5 CVSS 3.0

AV N AC L PR H UI N S U C N I H A H

A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_enterprise_nfv_infrastructure_software	>= unspecified < 3.12.1	3.12.1
cisco	enterprise_network_function_virtualization_infrastructure_sofware	< 3.12.1	3.12.1
cisco	enterprise_network_functions_virtualization_infrastructure	—	—

CVSS provenance

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:N/I:P/A:P

vendor_cisco 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20