CVE-2019-1648
Published Jan 24, 2019
Last updated 4 years ago
Overview
- Description
- A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An attacker could exploit this vulnerability by writing a crafted file to the directory where the user group configuration is located in the underlying operating system. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.
- Source
- ykramarz@cisco.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 3.0
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 7.2
- Impact score
- 10
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:C/I:C/A:C
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8569BEE0-3BDA-4349-9FAC-6ACE0A4E3C28"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93A1525E-AB99-4217-8C31-1F040710B155"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50272035-AE86-4BD5-88FA-929157267BC8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACE381F7-295F-4F05-84B0-3F07E099AD59"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "698D777B-1AB1-4A54-98EC-8948BF287DA9",
"versionEndExcluding": "18.4.0"
},
{
"criteria": "cpe:2.3:a:cisco:vbond_orchestrator:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA648664-0734-4D02-8944-CA4DF4D756D6"
},
{
"criteria": "cpe:2.3:a:cisco:vmanage_network_management:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDF9528B-1D1E-4CF2-ABA8-D01CC6F4A8BD"
},
{
"criteria": "cpe:2.3:a:cisco:vsmart_controller:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F16884C-A2EE-4867-8806-6418E000078C"
}
],
"operator": "OR"
}
]
}
]