CVE-2019-1821: high-severity vulnerability in Cisco Prime Infrastructure
Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.8epss 98%
from disclosure to weapon1 day
Published on NVDMay 16
1st PoC+1d
metasploitMay 15
VulnCheck+1644d
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Prime Infrastructurepublic PoCs found — 6✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47016exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47686githubgithub.com/k8gege/CiscoExploit★ 144vulncheckvulncheck.com/xdb/423b1aa3640cunverifiedvulncheckvulncheck.com/xdb/af7753f2b014unverifiedcve_referencepacketstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Prime Infrastructure
In the same product, most dangerous first.
CVE-2018-15379—Cisco Prime Infrastructure Arbitrary File Upload and Command Execution VulnerabilityEPSS 86.2%CVE-2019-1818MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityEPSS 13.6%CVE-2019-1819MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityEPSS 13.6%CVE-2019-1820MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal VulnerabilityEPSS 13.6%CVE-2019-1822HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesEPSS 4.4%CVE-2019-1823HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesEPSS 4.4%