CVE-2019-1755CWE-20

Cisco IOS XE Software Command Injection Vulnerability

Medium · published March 28, 2019

CVSS v3.0
6.5
EPSS
3%
Percentile
88.7
In the wild
Unconfirmed
What it is

A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the targeted application. A successful exploit could allow the attacker to execute arbitrary commands on the affected device.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03388 · 88.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2019-03-28T00:15Z
EPSS history
Timeline
  • 28 MAR 00:15Z
    Cisco IOS XE Software Command Injection Vulnerability
    cvelistv5