CVE-2019-1743

Summary

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco IOS XE Software16.2.1affected
CiscoCisco IOS XE Software16.2.2affected
CiscoCisco IOS XE Software16.3.1affected
CiscoCisco IOS XE Software16.3.2affected
CiscoCisco IOS XE Software16.3.3affected
CiscoCisco IOS XE Software16.3.1aaffected
CiscoCisco IOS XE Software16.3.4affected
CiscoCisco IOS XE Software16.3.5affected
CiscoCisco IOS XE Software16.3.5baffected
CiscoCisco IOS XE Software16.3.6affected
CiscoCisco IOS XE Software16.4.1affected
CiscoCisco IOS XE Software16.4.2affected
CiscoCisco IOS XE Software16.4.3affected
CiscoCisco IOS XE Software16.5.1affected
CiscoCisco IOS XE Software16.5.1aaffected
CiscoCisco IOS XE Software16.5.1baffected
CiscoCisco IOS XE Software16.5.2affected
CiscoCisco IOS XE Software16.5.3affected
CiscoCisco IOS XE Software16.6.1affected
CiscoCisco IOS XE Software16.6.2affected
CiscoCisco IOS XE Software16.6.3affected
CiscoCisco IOS XE Software16.7.1affected
CiscoCisco IOS XE Software16.7.1aaffected
CiscoCisco IOS XE Software16.7.1baffected
CiscoCisco IOS XE Software16.8.1affected
CiscoCisco IOS XE Software16.8.1aaffected
CiscoCisco IOS XE Software16.8.1baffected
CiscoCisco IOS XE Software16.8.1saffected
CiscoCisco IOS XE Software16.8.1caffected
CiscoCisco IOS XE Software16.8.1daffected
CiscoCisco IOS XE Software16.8.1eaffected

Weaknesses

  • CWE-20: CWE-20

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References