cisco enterprise-network-function-virtualization-infrastructure CVE-2019-1895 is a vulnerability in Cisco Enterprise Network Function Virtualization Infrastructure
Published on August 7, 2019

Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.

Vendor Advisory NVD

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Products Associated with CVE-2019-1895

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-1895 are published in Cisco Enterprise Network Function Virtualization Infrastructure:

Cisco Enterprise Network Function Virtualization Infrastructure
 

Affected Versions

Cisco Enterprise NFV Infrastructure Software:

Exploit Probability

EPSS
2.38%
Percentile
84.70%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.