CVE-2019-1935 in Integrated Management Controller
Summary
by MITRE
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2025
This vulnerability resides within Cisco's Integrated Management Controller Supervisor and UCS Director products, representing a critical authentication flaw that undermines the security posture of enterprise data centers. The vulnerability stems from the improper configuration of default accounts, specifically the SCP User account named scpuser, which exists with a well-documented username but an undocumented default password. This configuration pattern violates fundamental security principles by creating a known attack vector that remains unmitigated throughout the product lifecycle. The flaw is categorized under CWE-798, which specifically addresses the use of hard-coded credentials in software, and aligns with ATT&CK technique T1078.004 for valid accounts, as it leverages legitimate but insecure default credentials to establish unauthorized access.
The technical implementation of this vulnerability exploits the absence of mandatory password change enforcement during installation processes, creating a persistent security weakness that remains active until manually addressed by administrators. The scpuser account's default password is not enforced to change during system setup, meaning that any attacker who can reach the affected systems can immediately leverage this account to gain access to the Command Line Interface. This account possesses elevated privileges that extend beyond simple read operations, enabling full database access including read, write, and modification capabilities, which represents a complete compromise of system integrity and data confidentiality. The vulnerability's remote exploitability eliminates the need for physical access or additional attack vectors, making it particularly dangerous in networked environments where these systems are accessible from external networks.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it provides attackers with complete control over the affected systems and their underlying databases. Successful exploitation allows for arbitrary command execution with scpuser privileges, which can be leveraged to escalate privileges, exfiltrate sensitive data, modify system configurations, or establish persistent backdoors. The vulnerability affects multiple Cisco products including UCS Director and UCS Director Express for Big Data, indicating a widespread security flaw that impacts enterprise data center management platforms. Organizations utilizing these systems face significant risk of data breaches, system compromise, and potential regulatory compliance violations, particularly in environments where these products handle sensitive operational data or customer information.
Mitigation strategies for this vulnerability require immediate administrative action to address the default account configuration. Organizations should implement mandatory password change policies during initial system installation, disable or remove default accounts that are not actively required for operations, and enforce strong password policies across all system accounts. The recommended remediation includes changing the default password for the scpuser account to a complex, unique value that meets enterprise security requirements, as well as implementing network segmentation to limit access to these management systems. Additionally, security monitoring should be enhanced to detect unauthorized access attempts to default accounts, and regular security audits should be conducted to identify and remediate similar configuration weaknesses. This vulnerability demonstrates the critical importance of proper account management and the necessity of enforcing security policies during system deployment, as outlined in industry best practices for secure system configuration and the NIST Cybersecurity Framework.