CVE-2019-1742

MEDIUM

Cisco IOS XE - Unauthenticated Sensitive Configuration Information Exposure via Web UI

Title source: llm

Description

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to gain access to sensitive configuration information.

References (2)

Core 2

Core References

Patch, Vendor Advisory vendor-advisory x_refsource_cisco

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-xeid

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/107600

Scores

CVSS v3 5.3

EPSS 0.0222

EPSS Percentile 80.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-16

Status published

Products (23)

cisco/ios_xe 3.2.0ja

cisco/ios_xe 16.3.1

cisco/ios_xe 16.3.1a

cisco/ios_xe 16.3.2

cisco/ios_xe 16.3.3

cisco/ios_xe 16.3.4

cisco/ios_xe 16.3.5

cisco/ios_xe 16.3.5b

cisco/ios_xe 16.3.6

cisco/ios_xe 16.4.1

... and 13 more

Published Mar 28, 2019

Tracked Since Feb 18, 2026