CVE-2019-1835 : A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an a

A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information stored in an AP. The vulnerability is due to improper sanitization of user-supplied input in specific CLI commands. An attacker could exploit this vulnerability by accessing the CLI of an affected AP with administrator privileges and issuing crafted commands that result in directory traversal. A successful exploit could allow the attacker to view system files on the affected device, which could contain sensitive information. Software versions 8.8 and 8.9 are affected.

Published 2019-04-18 02:29:06

Updated 2019-10-09 23:48:17

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2019-1835

Cisco » Aironet Access Point Firmware » Version: 8.8
cpe:2.3:o:cisco:aironet_access_point_firmware:8.8:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Aironet 1542d » Version: N/A
When used together with: Cisco » Aironet 1542i » Version: N/A
When used together with: Cisco » Aironet 1562d » Version: N/A
When used together with: Cisco » Aironet 1562e » Version: N/A
When used together with: Cisco » Aironet 1562i » Version: N/A
When used together with: Cisco » Aironet 1800i » Version: N/A
When used together with: Cisco » Aironet 1850e » Version: N/A
When used together with: Cisco » Aironet 1850i » Version: N/A
When used together with: Cisco » Aironet 2800e » Version: N/A
When used together with: Cisco » Aironet 2800i » Version: N/A
When used together with: Cisco » Aironet 3800e » Version: N/A
When used together with: Cisco » Aironet 3800i » Version: N/A
When used together with: Cisco » Aironet 3800p » Version: N/A
Cisco » Aironet Access Point Firmware » Version: 8.9
cpe:2.3:o:cisco:aironet_access_point_firmware:8.9:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Aironet 1542d » Version: N/A
When used together with: Cisco » Aironet 1542i » Version: N/A
When used together with: Cisco » Aironet 1562d » Version: N/A
When used together with: Cisco » Aironet 1562e » Version: N/A
When used together with: Cisco » Aironet 1562i » Version: N/A
When used together with: Cisco » Aironet 1800i » Version: N/A
When used together with: Cisco » Aironet 1850e » Version: N/A
When used together with: Cisco » Aironet 1850i » Version: N/A
When used together with: Cisco » Aironet 2800e » Version: N/A
When used together with: Cisco » Aironet 2800i » Version: N/A
When used together with: Cisco » Aironet 3800e » Version: N/A
When used together with: Cisco » Aironet 3800i » Version: N/A
When used together with: Cisco » Aironet 3800p » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-1835

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 20 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1835

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.4	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	0.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.4	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	0.8	3.6	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2019-1835

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2019-1835

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-air-ap-traversal

Cisco Aironet Series Access Points Directory Traversal Vulnerability
Vendor Advisory
http://www.securityfocus.com/bid/108001

Cisco Aironet Series Access Points CVE-2019-1835 Local Directory Traversal Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2019-1835

Products affected by CVE-2019-1835

Exploit prediction scoring system (EPSS) score for CVE-2019-1835

CVSS scores for CVE-2019-1835

CWE ids for CVE-2019-1835

References for CVE-2019-1835