CVE-2019-1863
Estado: ModificadaAlta (8.1)—
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Puntuación base: 8.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.70%
- Percentil entre todas las CVEs puntuadas: 76
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1078Valid Accountsstealth · persistence · privilege escalation · initial access - Explotación
T1190Exploit Public-Facing Applicationinitial access - Impacto principal
T1068Exploitation for Privilege Escalationprivilege escalation - Impacto secundario
T1565.001Stored Data Manipulationimpact
Fuente: mapeo oficial MITRE CTID (CVE → ATT&CK).
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (2)
CWE
- CWE-285
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-1863",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2019-1863",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-21T18:57:15.263803Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 5.2,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Unified Computing System E-Series Software (UCSE)",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "2.0(13o)",
"versionType": "custom"
}
]
}
]
}
],
"published": "2019-08-21T19:15:14.277",
"references": [
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-privilege",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-privilege",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-285"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de administración basada en la web del software Cisco Integrated Management Controller (IMC) podría permitir que un atacante remoto autenticado realice cambios no autorizados en la configuración del sistema. La vulnerabilidad se debe a la insuficiente aplicación de la autorización. Un atacante podría aprovechar esta vulnerabilidad enviando una solicitud HTTP diseñada al software afectado. Una explotación exitosa podría permitir a un usuario con privilegios de solo lectura cambiar configuraciones críticas del sistema utilizando privilegios de administrador."
}
],
"lastModified": "2026-06-17T02:29:28.880",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:unified_computing_system:4.0\\(1c\\)hs3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39F8601E-730B-489B-AD2A-FD10FAF28595"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD570463-F539-47E7-B455-9376BD3EE99D",
"versionEndExcluding": "1.5\\(9g\\)",
"versionStartIncluding": "1.5.0.0"
},
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "416F7C96-3EF0-4B6D-B414-3FC0D0848144",
"versionEndExcluding": "2.0\\(13o\\)",
"versionStartIncluding": "2.0.0.0"
},
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0056011A-04F0-4185-8EE7-B1B30CAAA863",
"versionEndExcluding": "3.0\\(4k\\)",
"versionStartIncluding": "3.0.0.0"
},
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59EE9E78-D09E-4069-BC84-ED42E3EE76F1",
"versionEndExcluding": "4.0\\(4b\\)",
"versionStartIncluding": "4.0.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:encs_5100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "678F3A32-372A-441E-8115-95181FBAF628"
},
{
"criteria": "cpe:2.3:h:cisco:encs_5400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "01AE8153-6C23-46AB-BEAA-A6F27FDFEED7"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e1120d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DF77273F-73C0-40EB-BB4E-75269D46F074"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e140s-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "757958F5-F58C-4128-B128-D989A56ACA34"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F62D6B73-1AB7-4B93-A92E-275E78DF114C"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160s-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A0E6AAD9-824C-4126-8347-2FF1895E6D33"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e168d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3BD31E5A-518C-482F-A926-383ADCC7015E"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e180d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "155D990F-C7DA-48DD-92CC-18542DBBE572"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c125_m5:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ADD4A429-F168-460B-A964-8F1BD94C6387"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c4200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD25964B-08B7-477E-A507-5FE5EE7CD286"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_s3260:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2FDC8A69-0914-44C1-8AEA-262E0A285C81"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D094D51-8F25-430F-99C4-1A734CAA63E4",
"versionEndExcluding": "4.0\\(1d\\)",
"versionStartIncluding": "4.0.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:encs_5100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "678F3A32-372A-441E-8115-95181FBAF628"
},
{
"criteria": "cpe:2.3:h:cisco:encs_5400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "01AE8153-6C23-46AB-BEAA-A6F27FDFEED7"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e1120d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DF77273F-73C0-40EB-BB4E-75269D46F074"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e140s-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "757958F5-F58C-4128-B128-D989A56ACA34"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F62D6B73-1AB7-4B93-A92E-275E78DF114C"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160s-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A0E6AAD9-824C-4126-8347-2FF1895E6D33"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e168d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3BD31E5A-518C-482F-A926-383ADCC7015E"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e180d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "155D990F-C7DA-48DD-92CC-18542DBBE572"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c125_m5:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ADD4A429-F168-460B-A964-8F1BD94C6387"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c4200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD25964B-08B7-477E-A507-5FE5EE7CD286"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_s3260:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2FDC8A69-0914-44C1-8AEA-262E0A285C81"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9AB71C7-E751-4390-84B0-D88794FE2E5A",
"versionEndExcluding": "4.0\\(2c\\)",
"versionStartIncluding": "4.0.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:encs_5100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "678F3A32-372A-441E-8115-95181FBAF628"
},
{
"criteria": "cpe:2.3:h:cisco:encs_5400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "01AE8153-6C23-46AB-BEAA-A6F27FDFEED7"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e1120d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DF77273F-73C0-40EB-BB4E-75269D46F074"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e140s-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "757958F5-F58C-4128-B128-D989A56ACA34"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F62D6B73-1AB7-4B93-A92E-275E78DF114C"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e160s-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A0E6AAD9-824C-4126-8347-2FF1895E6D33"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e168d-m2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3BD31E5A-518C-482F-A926-383ADCC7015E"
},
{
"criteria": "cpe:2.3:h:cisco:ucs-e180d-m3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "155D990F-C7DA-48DD-92CC-18542DBBE572"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c125_m5:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ADD4A429-F168-460B-A964-8F1BD94C6387"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_c4200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD25964B-08B7-477E-A507-5FE5EE7CD286"
},
{
"criteria": "cpe:2.3:h:cisco:ucs_s3260:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2FDC8A69-0914-44C1-8AEA-262E0A285C81"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}