CVE-2019-1883

Cisco Integrated Management Controller CLI Command Injection Vulnerability

HIGH

7.8

CVSS Score

Published: August 21, 2019 at 06:20 PM UTC

Updated: June 17, 2026 at 02:29 AM UTC

14 products affected across 1 vendorUnified Computing SystemIntegrated Management Controller SupervisorUcs S3260

Using Cisco Unified Computing System E-Series Software (UCSE) by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Unified Computing System E-Series Software (UCSE) - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input on the command-line interface. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow an attacker to execute arbitrary commands on the device with root privileges.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Integrated Management Controller Supervisor · Cisco

95%

3.0.0.0 ≤ v < 3.0(4k)4.0.0.0 ≤ v < 4.0(2f)4.0.0.0 ≤ v < 4.0(4b)

Affected range stops below 3.0(4k), so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0(2f), so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0(4b), so it looks safe — our inference, not a vendor statement

cisco-encs-5100 (environment) · cisco-encs-5400 (environment) · cisco-ucs-c125-m5 (environment) · cisco-ucs-c4200 (environment) · cisco-ucs-e1120d-m3 (environment) · cisco-ucs-e140s-m2 (environment) · cisco-ucs-e160d-m2 (environment) · cisco-ucs-e160s-m3 (environment) · cisco-ucs-e168d-m2 (environment) · cisco-ucs-e180d-m3 (environment) · cisco-ucs-s3260 (environment)

Unified Computing System · Cisco

95%

4.0(1c)hs3

Unified Computing System E Series · Cisco

60%

v < 3.0(4k)

Affected range stops below 3.0(4k), so it looks safe — our inference, not a vendor statement

Encs 5100 · Ciscodevice

80%

All versions

Encs 5400 · Ciscodevice

80%