CVE-2019-1698

MEDIUM

Cisco IoT Field Network Director < 4.4(0.26) - Authenticated XML External Entity Injection via XML File Import

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-1698. PoCs published by raytran54.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2019-1698, focusing on the SQL injection vulnerability in the NotificationX WordPress plugin. It includes code references, patch diffs, and a step-by-step breakdown of the vulnerable code path.

Description

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.

Exploits (1)

nomisec WRITEUP
by raytran54 · poc
https://github.com/raytran54/CVE-2019-1698

This repository provides a detailed technical analysis of CVE-2019-1698, focusing on the SQL injection vulnerability in the NotificationX WordPress plugin. It includes code references, patch diffs, and a step-by-step breakdown of the vulnerable code path.

Classification
Writeup 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: NotificationX WordPress plugin
No auth needed
Prerequisites: WordPress installation with NotificationX plugin · Access to the REST API endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107093

Scores

CVSS v3 4.9
EPSS 0.0312
EPSS Percentile 86.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (1)
cisco/iot_field_network_director < 4.4\(0.26\)
Published Feb 21, 2019
Tracked Since Feb 18, 2026