Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-1946: Cisco NFVIS web interface lets remote attacker bypass login

CVE-2019-1946 · published 7 years ago

Summary

The web management console of Cisco Enterprise NFV Infrastructure Software can be tricked into granting access without a valid username or password. An attacker could view some configuration information and even upload a virtual machine image. Apply the vendor's security update or restrict network access to the management interface until it is patched.

What to do

Update cisco enterprise_nfv_infrastructure_software to version 3.10.1 or later.

Affected software

Vendor	Product	Affected versions
cisco	enterprise_nfv_infrastructure_software	< 3.10.1 `cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software::::::::`

Original advisory text

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementation of authentication in the web-based management interface. An attacker could exploit this vulnerability by sending a crafted authentication request to the web-based management interface on an affected system. A successful exploit could allow the attacker to view limited configuration details and potentially upload a virtual machine image.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published8 Aug 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-1946 · NVD

Track software like this

Free during beta