CVE-2019-1895
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user. The issue is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this by intercepting an administrator VNC session request prior to login.
Risk Assessment
An attacker can watch or interact with the administrator console session, potentially leading to unauthorized access to the device and compromise of the entire NFV infrastructure.
Recommendation
Apply patches provided by Cisco for NFVIS. Restrict access to the VNC console and implement stronger authentication mechanisms such as VPN or certificates.
Original NVD description (English source)
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.