CVE-2019-1736

Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability

MEDIUM

6.6

CVSS Score

Published: September 23, 2020 at 12:26 AM UTC

Updated: June 17, 2026 at 02:29 AM UTC

22 products affected across 1 vendorIdentity Services EngineUnified Computing SystemSns 3515-k9 Firmware

Using Cisco Identity Services Engine Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Identity Services Engine Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.6

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A successful exploit could allow the attacker to bypass the signature validation checks that are done by UEFI Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fmc1000-k9 BIOS · Cisco

95%

v < 4.0.1f.0

Affected range stops below 4.0.1f.0, so it looks safe — our inference, not a vendor statement

Fmc1000-k9 Firmware · Cisco

95%

v < 4.0.2h

Affected range stops below 4.0.2h, so it looks safe — our inference, not a vendor statement

Fmc2500-k9 BIOS · Cisco

95%

v < 4.0.1f.0

Affected range stops below 4.0.1f.0, so it looks safe — our inference, not a vendor statement

Fmc2500-k9 Firmware · Cisco

95%

v < 4.0.2h

Affected range stops below 4.0.2h, so it looks safe — our inference, not a vendor statement

Fmc4500-k9 BIOS · Cisco

95%

v < 4.0.1f.0

Affected range stops below 4.0.1f.0, so it looks safe — our inference, not a vendor statement

Fmc4500-k9 Firmware · Cisco

95%

v < 4.0.2h

Affected range stops below 4.0.2h, so it looks safe — our inference, not a vendor statement

Identity Services Engine · Cisco

95%

2.4(0.357)2.6(0.156)

Sns 3515-k9 BIOS · Cisco

95%

v < 4.0.2d

Affected range stops below 4.0.2d, so it looks safe — our inference, not a vendor statement

Sns 3515-k9 Firmware · Cisco

95%

v < 4.0.2h

Affected range stops below 4.0.2h, so it looks safe — our inference, not a vendor statement

Sns 3595-k9 BIOS · Cisco

95%

v < 4.0.2d

Affected range stops below 4.0.2d, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-ucs-boot-bypass

References (1)

Vendor Advisoryx_refsource_CISCOPatch

Source: [email protected]

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-ucs-boot-bypass

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.6MEDIUM[email protected]

Attack Vector: PHYSICAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-347

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card