CVE-2019-1900 Cisco Integrated Management Controller Unauthenticated Denial of Service Vulnerability

High 7.5 Published 21 Aug 2019 Updated 19 Nov 2024

Unauthenticated remote attackers can crash the Cisco IMC web server via crafted HTTP requests, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1900?

CVE-2019-1900 is a high-severity vulnerability in Cisco Unified Computing System, published on 21 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of user-supplied input on the web interface. An attacker could exploit this vulnerability by submitting a crafted HTTP request to certain endpoints of the affected software. A successful exploit could allow an attacker to cause the web server to crash. Physical access to the device may be required for a restart.

Weakness: CWE-476

Which versions are affected by CVE-2019-1900?

It affects 2 products.

Products include Cisco Integrated Management Controller Supervisor, Cisco Unified Computing System.

How do I fix CVE-2019-1900?

No fix has been published for CVE-2019-1900 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1900 being exploited?

There is no known exploitation of CVE-2019-1900 in the wild and no public exploit code.

All Cisco Unified Computing System vulnerabilities

Sources

Also known as GHSA-7674-7g97-mwgj.