6.5med
CVE-2019-16004
Cisco Vision Dynamic Signage Director Authentication Bypass Vulnerability
Published 6 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to missing authentication on some of the API calls. An attacker could exploit this vulnerability by sending a request to one of the affected calls. A successful exploit could allow the attacker to interact with some parts of the API.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Affected products
- Cisco Cisco Vision Dynamic Signage Director
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-vdsd-auth-bypass · vendor-advisory, x_refsource_CISCO, x_transferred
Sources
- CVE List: CVE-2019-16004
- NVD: CVE-2019-16004
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.