CVE-2019-1698

Medium

Description

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.

SeverityMedium

CVSS4.9

Exploit probability—

Product

Cisco Iot Field Network Director

PublishedFeb 21, 2019

First seenFeb 21, 2019

Weakness typeCWE-611XML external entity (XXE)

How to fix

Update

cisco iot_field_network_director4.4\(0.26\) or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-iot-fnd-xml

Affected products

Product	Affected versions	Fixed in
cisco iot_field_network_director	v < 4.4\(0.26\)	4.4\(0.26\)

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.