CVE-2019-1880

Cisco Unified Computing System BIOS Signature Bypass Vulnerability

MEDIUM

4.4

CVSS Score

Published: June 5, 2019 at 04:30 PM UTC

Updated: June 17, 2026 at 02:29 AM UTC

9 products affected across 1 vendorUnified Computing System Server FirmwareUnified Computing System C220 M4Unified Computing System C220 M5

Using Cisco Unified Computing System (Managed) by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Unified Computing System (Managed) - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.4

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Unified Computing System Server Firmware · Cisco

95%

v < 3.0(4l)v < 4.0(2g)v < 4.0(4c)4.0 ≤ v < 4.0(2g)

Affected range stops below 3.0(4l), so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0(2g), so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0(4c), so it looks safe — our inference, not a vendor statement

cisco-unified-computing-system-c125-m5 (environment) · cisco-unified-computing-system-c220-m4 (environment) · cisco-unified-computing-system-c220-m5 (environment) · cisco-unified-computing-system-c240-m4 (environment) · cisco-unified-computing-system-c240-m5 (environment) · cisco-unified-computing-system-c460-m4 (environment) · cisco-unified-computing-system-c480-m5 (environment)

Unified Computing System · Cisco

60%

v < 4.0(4c)

Affected range stops below 4.0(4c), so it looks safe — our inference, not a vendor statement

Unified Computing System C125 M5 · Ciscodevice

80%

All versions

Unified Computing System C220 M4 · Ciscodevice

80%

All versions

Unified Computing System C220 M5 · Ciscodevice

80%