CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability

Medium 6.7 Published 6 Jul 2019 Updated 20 Nov 2024

Local administrators can execute arbitrary code with service privileges by placing a malicious file in a specific directory due to insufficient module validation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1932?

CVE-2019-1932 is a medium-severity code injection vulnerability in Cisco AMP for Endpoints, published on 6 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service.

Weakness: CWE-345

Which versions are affected by CVE-2019-1932?

It affects 1 product.

Products include Cisco Advanced Malware Protection for Endpoints.

How do I fix CVE-2019-1932?

No fix has been published for CVE-2019-1932 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-1932 being exploited?

There is no known exploitation of CVE-2019-1932 in the wild and no public exploit code.

Sources

Also known as GHSA-cwr2-8r52-4r98.