{"id":"CVE-2019-1821","published":"2019-05-16T01:10:39Z","modified":"2024-11-20T17:18:12Z","title":"Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities","vendor":"Cisco","product":"Cisco Prime Infrastructure","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"Cisco Prime Infrastructure","versions":["3.4"]}],"description":{"text":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager stems from improper validation of user-supplied input. An authenticated remote attacker who uploads a malicious file to the administrative web interface can execute code with root-level privileges on the underlying operating system, requiring only low-privileged credentials and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:57Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.98051,"percentile":0.9991,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-15","exploitedFirstSeen":"2023-11-15","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2019-1821","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2019-1821","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2019-1821","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-21&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2019-1821","date":"2024-01-26"}],"evidenceTotal":745,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"blockioc","url":"https://otx.alienvault.com/pulse/68f49c515f89bb9e923f95ff","created":"2025-10-19"},{"name":"Operation Muzabi: Phishing Target Reconnaissance and Attack Resource Analysis","url":"https://otx.alienvault.com/pulse/608c75593de1fe5ca6a8ca26","created":"2021-04-30"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www.securityfocus.com/bid/108339","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-10378","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10378","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":47016,"url":"https://www.exploit-db.com/exploits/47016","title":"Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit)","type":"remote","platform":"linux","date":"2019-06-20","verified":true,"provenance":"source"},{"id":47686,"url":"https://www.exploit-db.com/exploits/47686","title":"Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution","type":"remote","platform":"linux","date":"2019-05-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-05-17"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-05-21","earliestUrl":"https://github.com/k8gege/CiscoExploit","repos":[{"name":"k8gege/CiscoExploit","url":"https://github.com/k8gege/CiscoExploit","stars":143,"created":"2019-05-21"}]},"metasploit":[{"name":"Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability","module":"exploit/linux/http/cpi_tararchive_upload","type":"exploit","disclosureDate":"2019-05-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cpi_tararchive_upload.rb"}],"nuclei":[{"id":"CVE-2019-1821","name":"Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution","severity":"critical","path":"http/cves/2019/CVE-2019-1821.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1821.yaml"}],"first":{"date":"2019-05-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cpi_tararchive_upload.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html"],"flow":[],"timeline":[{"date":"2019-05-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-05-17, PoC-in-GitHub 2019-05-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cpi_tararchive_upload.rb","provenance":"source"},{"date":"2019-05-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-1821","provenance":"source"},{"date":"2023-11-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2019-1821","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1079 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}