Vulnerability in Cisco Unified Computing System (Managed)
CVE-2019-1880
A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.
EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Cisco Unified Computing System (Managed) — versions unspecified
- Cisco Unified_computing_system_c125_m5
- Cisco Unified_computing_system_c220_m4
- Cisco Unified_computing_system_c220_m5
- Cisco Unified_computing_system_c240_m4
- Cisco Unified_computing_system_c240_m5
- Cisco Unified_computing_system_c460_m4
- Cisco Unified_computing_system_c480_m5
- Cisco Unified_computing_system_server_firmware
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-1880?
- CVE-2019-1880 is a medium-severity vulnerability in Cisco Unified Computing System (Managed), classified under Insufficient Verification of Data Authenticity. CVSS score: 4.4/10. Published 2019-06-05.
- How severe is CVE-2019-1880?
- Medium severity. CVSS v3 base score is 4.4 out of 10.