CVE-2019-1974 is a critical authentication bypass vulnerability in the web-based management interfaces of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data. Due to insufficient request header validation, an unauthenticated, remote attacker can gain full administrative access to affected devices. This vulnerability has a CVSS score of 9.8 (Critical), indicating a network-attackable, low-complexity exploit with high impact on confidentiality, integrity, and availability. While no public exploit code is currently available in common frameworks like Metasploit or Nuclei, the vulnerability has garnered significant community discussion and media coverage, suggesting a high level of awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.2.0.0, <= 2.2.0.6CPE matchmatch criteria | cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:* | ||
2.1.0.0CPE matchmatch criteria | cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1.0.0:*:*:*:*:*:*:* | ||
>= 5.5.0.0, <= 5.5.0.2CPE matchmatch criteria | cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:* | ||
>= 6.0.0.0, <= 6.0.1.3CPE matchmatch criteria | cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:* | ||
>= 6.5.0.0, <= 6.5.0.3CPE matchmatch criteria | cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.