Vulnerability Details : CVE-2019-1648
A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An attacker could exploit this vulnerability by writing a crafted file to the directory where the user group configuration is located in the underlying operating system. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.
Vulnerability category: Input validation
Products affected by CVE-2019-1648
- cpe:2.3:a:cisco:vbond_orchestrator:-:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:vmanage_network_management:-:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:vsmart_controller:-:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-1648
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-1648
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
Cisco Systems, Inc. | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-1648
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
Assigned by: ykramarz@cisco.com (Secondary)
References for CVE-2019-1648
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-sdwan-sol-escal
Cisco SD-WAN Solution Privilege Escalation VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/106719
Cisco SD-WAN Solution CVE-2019-1648 Local Privilege Escalation VulnerabilityThird Party Advisory;VDB Entry
Jump to