CVE-2019-1681— Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability

Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability

A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitrary files from the targeted device, possibly resulting in information disclosure. The vulnerability is due to improper validation of user-supplied input within TFTP requests processed by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques in malicious requests sent to the TFTP service on a targeted device. An exploit could allow the attacker to retrieve arbitrary files from the targeted device, resulting in the disclosure of sensitive information. This vulnerability affects Cisco IOS XR Software releases prior to Release 6.5.2 for Cisco Network Convergence System 1000 Series devices when the TFTP service is enabled.

N/A

信息暴露

Cisco Network Convergence System 1000 Series IOS XR Software 信息泄露漏洞

Cisco Network Convergence System 1000 Series是美国思科（Cisco）公司的一款1000系列路由器。IOS XR Software是运行在其中的一套模块化、分布式的网络操作系统。 Cisco Network Convergence System 1000 Series中的IOS XR Software 6.5.2之前版本存在信息泄露漏洞，该漏洞源于程序没有正确地过滤TFTP请求中用户提交的输入。在TFTP服务被启用时，攻击者可通过向目标设备发送恶意的请求利用该漏洞

N/A

N/A