Vulnslist

find the latest Cisco vulnerabilities

Cisco Network Assurance Engine CLI Access with Default Password Vulnerability

cisco-sa-20190212-nae-dos · High · Published · Updated

A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault in the password management system of NAE. An attacker could exploit this vulnerability by authenticating with the default administrator password via the CLI of an affected server. A successful exploit could allow the attacker to view potentially sensitive information or bring the server down, causing a DoS condition. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos

Cisco advisory ·CSAF JSON

Workarounds

The default administrator password can be changed from the CLI by setting a new password with the passwd command. Customers wishing to implement this workaround should contact Cisco TAC (Technical Assistance Center) so the default password can be entered securely over a remote support session. This will need to be done for all nodes in the cluster.

CVEsCVE-2019-1688
Cisco Bug IDsCSCvo18229
CVSS ScoreBase 7.7
Base 7.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco Network Assurance Engine

CSAF Product Statuses

Product Status Source CVE Rows
Cisco Network Assurance Engine known_affected cisco_csaf CVE-2019-1688 1

Related Products

Product CVE Evidence
Cisco Network Assurance Engine CVE-2019-1688 Cisco OpenVuln