Published: 21/08/2019 Updated: 17/07/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Subscribe to Integrated Management Controller Supervisor

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote malicious user to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the malicious user to use the acquired session token to gain full administrator access to the affected device.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco integrated management controller supervisor
cisco ucs director
cisco ucs director 6.7\\(0.0.67265\\)
cisco ucs director express for big data 3.6.0.0
cisco ucs director express for big data

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication The vulnerability is due to i ...

[+] Exploit Title: Cisco UCS-IMC Supervisor 2200 - Authentication Bypass [+] Cisco IMC Supervisor - < 2210 [+] Date: 08/21/2019 [+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo [+] Vendor: wwwciscocom/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/indexhtml [+] Vulnera ...

Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data suffer from default password, authentication bypass, and command injection vulnerabilities ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator The second one, CVE-2019-1936, is a command injection in a password change form, ...

Cisco UCS-IMC Supervisor version 2200 suffers from an authentication bypass vulnerability ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator The second one, CVE-2019-1936, is a command inje ...

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one, CVE-2019-1936, is a command injection in a password change form, that allows the attacker to inject commands that will execute as root. This module combines both vulnerabilities to achieve the unauthenticated command injection as root. It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in their advisory that their IMC Supervisor and UCS Director Express are also affected by these vulnerabilities, but this module was not tested with those products.

msf > use exploit/linux/http/cisco_ucs_rce
msf exploit(cisco_ucs_rce) > show targets
    ...targets...
msf exploit(cisco_ucs_rce) > set TARGET < target-id >
msf exploit(cisco_ucs_rce) > show options
    ...show and set options...
msf exploit(cisco_ucs_rce) > exploit

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one, CVE-2019-1936, is a command injection in a password change form, that allows the attacker to inject commands that will execute as root. This module combines both vulnerabilities to achieve the unauthenticated command injection as root. It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in their advisory that their IMC Supervisor and UCS Director Express are also affected by these vulnerabilities, but this module was not tested with those products.

msf > use exploit/linux/http/cisco_ucs_rce
msf exploit(cisco_ucs_rce) > show targets
    ...targets...
msf exploit(cisco_ucs_rce) > set TARGET < target-id >
msf exploit(cisco_ucs_rce) > show options
    ...show and set options...
msf exploit(cisco_ucs_rce) > exploit

The Joy of Six... critical security patches: Cisco small biz switches open to hijacking via web UI

The Register • Shaun Nichols in San Francisco • 22 Aug 2019

Plus UCS and other gear need updates Breaker, breaker. Apple's iOS 12.4 update breaks jailbreak break, un-breaks the break. 10-4

Cisco has emitted a fresh round of software updates to address security holes in its network switches and controllers. Switchzilla's latest patch bundle includes six alerts for what it rates as critical issues, including flaws in its Small Business 220 Series switches and UCS Director software. Combined with Cisco's fixes for 'high' and 'moderate' issues, the networking giant posted a total of 33 security alerts on Wednesday. For the Small Business 220 Switches, a pair of patches address CVE-201...

CVE-2019-1937

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Metasploit Modules

Recent Articles

References

Vulmon Search

About

Products

Connect