CVE-2019-1743

Cisco IOS XE Software Arbitrary File Upload Vulnerability

State: Published
Severity: 8.8 High
Published: Mar 27, 2019
Updated: Nov 20, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-20

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	16.2.1Affected 16.2.2Affected 16.3.1Affected 16.3.2Affected 16.3.3Affected 16.3.1aAffected 16.3.4Affected 16.3.5Affected 16.3.5bAffected 16.3.6Affected 16.4.1Affected 16.4.2Affected 16.4.3Affected 16.5.1Affected 16.5.1aAffected 16.5.1bAffected 16.5.2Affected 16.5.3Affected 16.6.1Affected 16.6.2Affected 16.6.3Affected 16.7.1Affected 16.7.1aAffected 16.7.1bAffected 16.8.1Affected and 6 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

16.2.1Affected
16.2.2Affected
16.3.1Affected
16.3.2Affected
16.3.3Affected
16.3.1aAffected
16.3.4Affected
16.3.5Affected
16.3.5bAffected
16.3.6Affected
16.4.1Affected
16.4.2Affected
16.4.3Affected
16.5.1Affected
16.5.1aAffected
16.5.1bAffected
16.5.2Affected
16.5.3Affected
16.6.1Affected
16.6.2Affected
16.6.3Affected
16.7.1Affected
16.7.1aAffected
16.7.1bAffected
16.8.1Affected
and 6 more versions

References

20190327 Cisco IOS XE Software Arbitrary File Upload Vulnerabilityvendor-advisory
107591vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.