CVE-2019-1976: high-severity vulnerability in Cisco Industrial Network Director
Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 2.0%
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access restrictions on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access running configuration information about devices managed by the IND, including administrative credentials.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco Industrial Network DirectorRelated CVEs — Cisco Industrial Network Director
In the same product, most dangerous first.
CVE-2023-20036CRITICALCisco Industrial Network Director Command Injection VulnerabilityEPSS 13.8%CVE-2019-1861HIGHCisco Industrial Network Director Remote Code Execution VulnerabilityEPSS 4.3%CVE-2019-1881MEDIUMCisco Industrial Network Director Cross-Site Request Forgery VulnerabilityEPSS 1.3%CVE-2020-3567MEDIUMCisco Industrial Network Director Denial of Service VulnerabilityEPSS 1.2%CVE-2019-1940MEDIUMCisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure VulnerabilityEPSS 1.0%CVE-2019-1882MEDIUMCisco Industrial Network Director Stored Cross-Site Scripting VulnerabilityEPSS 0.9%