CVE-2019-1971
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The issue is due to insufficient input validation by the web portal framework. An attacker could exploit this by providing malicious input during web portal authentication.
Risk Assessment
An attacker can gain full control over the underlying operating system, potentially leading to complete compromise of NFV infrastructure and network security.
Recommendation
Apply patches provided by Cisco for NFVIS. Restrict access to the web portal and implement logging monitoring for suspicious authentication attempts.
Original NVD description (English source)
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.