Published: 21/08/2019 Updated: 03/03/2023

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2

VMScore: 980

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote malicious user to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco integrated management controller supervisor
cisco integrated management controller supervisor 2.1.0.0
cisco ucs director 6.7\\(0.0.67265\\)
cisco ucs director 6.0.0.0
cisco ucs director 6.5.0.0
cisco ucs director 6.6.0.0
cisco ucs director 6.6.1.0
cisco ucs director 6.7.0.0
cisco ucs director 6.7.1.0
cisco ucs director express for big data 3.6.0.0
cisco ucs director express for big data 3.0.0.0
cisco ucs director express for big data 3.5.0.0
cisco ucs director express for big data 3.7.0.0
cisco ucs director express for big data 3.7.1.0

Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data suffer from default password, authentication bypass, and command injection vulnerabilities ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator The second one, CVE-2019-1936, is a command injection in a password change form, ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator The second one, CVE-2019-1936, is a command inje ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one, CVE-2019-1936, is a command injection in a password change form, that allows the attacker to inject commands that will execute as root. This module combines both vulnerabilities to achieve the unauthenticated command injection as root. It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in their advisory that their IMC Supervisor and UCS Director Express are also affected by these vulnerabilities, but this module was not tested with those products.

msf > use exploit/linux/http/cisco_ucs_rce
msf exploit(cisco_ucs_rce) > show targets
    ...targets...
msf exploit(cisco_ucs_rce) > set TARGET < target-id >
msf exploit(cisco_ucs_rce) > show options
    ...show and set options...
msf exploit(cisco_ucs_rce) > exploit

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one, CVE-2019-1936, is a command injection in a password change form, that allows the attacker to inject commands that will execute as root. This module combines both vulnerabilities to achieve the unauthenticated command injection as root. It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in their advisory that their IMC Supervisor and UCS Director Express are also affected by these vulnerabilities, but this module was not tested with those products.

msf > use exploit/linux/http/cisco_ucs_rce
msf exploit(cisco_ucs_rce) > show targets
    ...targets...
msf exploit(cisco_ucs_rce) > set TARGET < target-id >
msf exploit(cisco_ucs_rce) > show options
    ...show and set options...
msf exploit(cisco_ucs_rce) > exploit

CWE-20 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-cmdinj https://seclists.org/bugtraq/2019/Aug/49 http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html http://seclists.org/fulldisclosure/2019/Aug/36 http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html https://nvd.nist.gov https://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html https://www.rapid7.com/db/modules/exploit/linux/http/cisco_ucs_rce/

CVE-2019-1936

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect