Evil-DB LogoEvil-DB
← All CVEs

CVE-2019-12630

critical · 9.8

A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of casuser.

9.8
CVSS
65.8%
EPSS (exploit prob.)
99th
EPSS percentile
2019-10-02
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20CWE-502

Affected products

VendorProductAffected versions
ciscosecurity_manager< 4.18

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-12630