CVE-2019-1698— Cisco IoT Field Network Director 代码问题漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2019-1698の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Cisco IoT Field Network Director XML External Entity Vulnerability
ソース: NVD (National Vulnerability Database)
脆弱性説明
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
XML外部实体引用的不恰当限制(XXE)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Cisco IoT Field Network Director 代码问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Cisco IoT Field Network Director（IoT-FND）是美国思科（Cisco）公司的一套端到端的物联网管理系统。该系统具有设备管理、资产跟踪和智能计量等功能。 Cisco IoT Field Network Director中的Cisco Internet的基于Web的用户界面存在XML外部实体注入漏洞，该漏洞源于程序在解析XML文件时，错误地处理了XML外部实体条目。攻击者可通过导入带有恶意条目的XML文件利用该漏洞获取设备所存储信息的读取权限。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Cisco | Cisco IoT Field Network Director (IoT-FND) | unspecified ~ 4.4(0.26) | - |
II. CVE-2019-1698の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | None | https://github.com/raytran54/CVE-2019-1698 | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2019-1698のインテリジェンス情報
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-iot-fnd-xmlvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2019-1698
Same Patch Batch · Cisco · 2019-02-21 · 12 CVEs total
| CVE-2019-1659 | Cisco Prime Infrastructure Certificate Validation Vulnerability | |
| CVE-2019-1662 | Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability | |
| CVE-2019-1664 | Cisco HyperFlex Software Unauthenticated Root Access Vulnerability | |
| CVE-2019-1665 | Cisco Hyperflex Stored Cross-Site Scripting Vulnerability | |
| CVE-2019-1666 | Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability | |
| CVE-2019-1667 | Cisco HyperFlex Arbitrary Statistics Write Vulnerability | |
| CVE-2019-1681 | Cisco Network Convergence System 1000 Series TFTP Directory Traversal Vulnerability | |
| CVE-2019-1684 | Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Prot | |
| CVE-2019-1685 | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability | |
| CVE-2019-1691 | Cisco Firepower Threat Defense Software SSL or TLS Denial of Service Vulnerability | |
| CVE-2019-1700 | Cisco Firepower 9000 Series Firepower 2-Port 100G Double-Width Network Module Queue Wedge |
IV. 関連脆弱性
- CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi - CVE-2026-20168
Cisco IoT Field Network Director Path Traversal Vulnerabilit - CVE-2020-3531
Cisco IoT Field Network Director Unauthenticated REST API Vu - CVE-2020-3392
Cisco IoT Field Network Director Missing API Authentication
同じベンダー: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
同じ弱点: CWE-611
- CVE-2026-41936
Vvveb < 1.0.8.2 XML External Entity Injection via Import - CVE-2026-40682
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntr - CVE-2026-6501
ILM Informatique jOpenDocument 代码问题漏洞 - CVE-2025-14543
Improper Restriction of XML External Entity Reference vulner - CVE-2024-13971
Arbitrary File Read and Server Side Request Forgery via XML
V. CVE-2019-1698へのコメント
まだコメントはありません