CVE-2019-1950 : A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated,

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.

Published 2020-02-19 20:15:14

Updated 2023-05-22 18:57:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2019-1950

Cisco » Ios Xe
Versions up to, including, (<=) 16.11
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » Asr 1000-x » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Csr1000v » Version: N/A
When used together with: Cisco » Ir1101 » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
When used together with: Cisco » Ucs-e1120d-m3 » Version: N/A
When used together with: Cisco » Ucs-e140s-m2 » Version: N/A
When used together with: Cisco » Ucs-e160d-m2 » Version: N/A
When used together with: Cisco » Ucs-e160s-m3 » Version: N/A
When used together with: Cisco » Ucs-e180d-m2 » Version: N/A
When used together with: Cisco » Ucs-e180d-m3 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-1950

EPSS FAQ

0.39%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1950

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-1950

CWE-255

Assigned by: ykramarz@cisco.com (Secondary)
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-1950

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259

Cisco IOS XE SD-WAN Software Default Credentials Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-1950

Products affected by CVE-2019-1950

Exploit prediction scoring system (EPSS) score for CVE-2019-1950

CVSS scores for CVE-2019-1950

CWE ids for CVE-2019-1950

References for CVE-2019-1950