====================================================================

                             CERT-Renater

                 Note d'Information No. 2019/VULN041

_____________________________________________________________________

DATE                : 12/02/2019

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Network Assurance Engine.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos
_____________________________________________________________________

Cisco Security Advisory: Cisco Network Assurance Engine CLI Access with
Default Password Vulnerability

Advisory ID: cisco-sa-20190212-nae-dos

Revision: 1.0

For Public Release: 2019 February 12 16:00 GMT

Last Updated: 2019 February 12 16:00 GMT

CVE ID(s): CVE-2019-1688

CVSS Score v(3): 7.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the management web interface of Cisco Network
Assurance Engine (NAE) could allow an unauthenticated, local attacker to
gain unauthorized access or cause a Denial of Service (DoS) condition on
the server.

The vulnerability is due to a fault in the password management system of
NAE. An attacker could exploit this vulnerability by authenticating with
the default administrator password via the CLI of an affected server. A
successful exploit could allow the attacker to view potentially
sensitive information or bring the server down, causing a DoS condition.

Cisco has released software updates that address this vulnerability.
There are workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos"]

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================