Cisco Integrated Management Controller CLI hard-coded credentials

Summaryinfo

A vulnerability was found in Cisco Integrated Management Controller, UCS Director and UCS Director Express for Big Data. It has been classified as critical. The impacted element is an unknown function of the component CLI. Performing a manipulation results in hard-coded credentials. This vulnerability is known as CVE-2019-1935. Remote exploitation of the attack is possible. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Integrated Management Controller, UCS Director and UCS Director Express for Big Data (Virtualization Software) (unknown version). This affects an unknown code block of the component CLI. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.

The weakness was published 08/21/2019 as cisco-sa-20190821-imcs-usercre as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2019-1935 since 12/06/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

A public exploit has been developed by Pedro Ribeiro (pedrib) in Ruby/Metasploit and been published 2 weeks after the advisory. The exploit is shared for download at exploit-db.com. It is declared as functional. We expect the 0-day to have been worth approximately $5k-$25k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47346). Similar entries are available at VDB-140567 and VDB-140566. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• Integrated Management Controller
• UCS Director
• UCS Director Express for Big Data

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion