CVE-2019-1895— Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2019-1895
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Enterprise NFV Infrastructure Software 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Enterprise NFV Infrastructure Software（NFVIS）是美国思科（Cisco）公司的一套NVF基础架构软件平台。该平台可以通过中央协调器和控制器实现虚拟化服务的全生命周期管理。 Cisco Enterprise NFVIS 3.12.1之前版本中Virtual Network Computing (VNC)控制台的实现存在访问控制错误漏洞。远程攻击者可通过在登录之前拦截管理员VNC会话利用该漏洞访问管理用户的VNC控制台会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Enterprise NFV Infrastructure Software | unspecified ~ 3.12.1 | - |
II. Public POCs for CVE-2019-1895
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-1895
请登录查看更多情报信息。
- Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerabilityvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2019-1895
Same Patch Batch · Cisco · 2019-08-07 · 15 CVEs total
| CVE-2019-1945 | Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities | |
| CVE-2019-1928 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1929 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1934 | Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escala | |
| CVE-2019-1944 | Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities | |
| CVE-2019-1926 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1927 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1918 | Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service Vulnera | |
| CVE-2019-1924 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1925 | Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulne | |
| CVE-2019-1910 | Cisco IOS XR Software Intermediate System to Intermediate System Denial of Service Vulnera | |
| CVE-2019-1913 | Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities | |
| CVE-2019-1914 | Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability | |
| CVE-2019-1912 | Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Enterprise NFV Infrastructure Software
- CVE-2026-20090
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20089
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20087
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20088
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20096
Cisco Integrated Management Controller Command Injection Vul
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-306
- CVE-2021-47940
WordPress Download From Files 1.48 Arbitrary File Upload - CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload - CVE-2021-47933
WordPress MStore API 2.0.6 Arbitrary File Upload - CVE-2026-8185
UGREEN CM933 Administrative missing authentication - CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via cod
V. Comments for CVE-2019-1895
No comments yet