CVE-2019-1698 Cisco IoT Field Network Director XML External Entity Vulnerability

Medium 4.9 Published 21 Feb 2019 Updated 21 Nov 2024

An authenticated attacker can read sensitive files on Cisco IoT Field Network Director by importing a crafted XML file exploiting an XXE vulnerability.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1698?

CVE-2019-1698 is a medium-severity vulnerability in Cisco IoT Field Network Director (IoT-FND), published on 21 Feb 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.

Weakness: CWE-611

Which versions are affected by CVE-2019-1698?

It affects 1 product.

Products include Cisco Iot Field Network Director.

How do I fix CVE-2019-1698?

No fix has been published for CVE-2019-1698 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1698 being exploited?

There is no known exploitation of CVE-2019-1698 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-53cf-9pqv-xjxx.