Cisco Enterprise Network Function Virtualization Infrastructure
By the Year
In 2024 there have been 0 vulnerabilities in Cisco Enterprise Network Function Virtualization Infrastructure . Enterprise Network Function Virtualization Infrastructure did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 4 | 7.00 |
| 2019 | 10 | 6.45 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Enterprise Network Function Virtualization Infrastructure vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cisco Enterprise Network Function Virtualization Infrastructure Security Vulnerabilities
A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2020-3365
6.5 - Medium
- September 04, 2020
A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directory permissions. An attacker could exploit this vulnerability by using capabilities that are not controlled by the role-based access control (RBAC) mechanisms of the software. A successful exploit could allow the attacker to overwrite files on an affected device.
Directory traversal
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files
CVE-2020-3478
8.1 - High
- September 04, 2020
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
Improper Input Validation
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2020-3236
6.7 - Medium
- June 18, 2020
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files. The attacker would need valid administrative credentials. This vulnerability is due to improper input validation of CLI command arguments. An attacker could exploit this vulnerability by using path traversal techniques when executing a vulnerable command. A successful exploit could allow the attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files on an affected device.
Directory traversal
A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2020-3138
6.7 - Medium
- February 19, 2020
A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device.
Improper Verification of Cryptographic Signature
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1946
6.5 - Medium
- August 08, 2019
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementation of authentication in the web-based management interface. An attacker could exploit this vulnerability by sending a crafted authentication request to the web-based management interface on an affected system. A successful exploit could allow the attacker to view limited configuration details and potentially upload a virtual machine image.
authentification
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1952
6.7 - Medium
- August 08, 2019
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary files. The attacker would need valid administrator privilege-level credentials. This vulnerability is due to improper input validation of CLI command arguments. An attacker could exploit this vulnerability by using directory traversal techniques when executing a vulnerable command. A successful exploit could allow the attacker to overwrite or read arbitrary files on an affected device.
Improper Input Validation
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1953
6.5 - Medium
- August 08, 2019
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.
Insertion of Sensitive Information into Log File
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1959
4.4 - Medium
- August 08, 2019
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Improper Input Validation
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1960
4.4 - Medium
- August 08, 2019
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Improper Input Validation
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1961
4.9 - Medium
- August 08, 2019
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.
Improper Input Validation
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1971
9.8 - Critical
- August 08, 2019
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.
Improper Input Validation
A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could
CVE-2019-1972
6.7 - Medium
- August 08, 2019
A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions during the execution of an affected command. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.
Permissions, Privileges, and Access Controls
A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1973
4.8 - Medium
- August 08, 2019
A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
XSS
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could
CVE-2019-1895
9.8 - Critical
- August 07, 2019
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.
Missing Authentication for Critical Function
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Cisco Enterprise Network Function Virtualization Infrastructure or by Cisco? Click the Watch button to subscribe.
