CVE-2019-1822

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Weakness classification

• CWE-20: Improper Input Validation

Primary references

• psirt@cisco.com — Broken Link, Third Party Advisory, VDB Entry
• psirt@cisco.com — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory