Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability
Priority LOW 31CWE-347Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.
Summary
A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A successful exploit could allow the attacker to bypass the signature validation checks that are done by UEFI Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software | all versions | — | No fix listed | CNA |
- Cisco Identity Services Engine Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:fmc1000-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1f.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:fmc1000-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:o:cisco:fmc2500-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1f.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:fmc2500-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:o:cisco:fmc4500-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1f.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:fmc4500-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3515-k9_bios:*:*:*:*:*:*:*:* | before 4.0.2d | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3515-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3595-k9_bios:*:*:*:*:*:*:*:* | before 4.0.2d | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3595-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
- cpe:2.3:o:cisco:fmc1000-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1f.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:fmc1000-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:o:cisco:fmc2500-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1f.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:fmc2500-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:o:cisco:fmc4500-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1f.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:fmc4500-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3515-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.2d Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3515-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3595-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.2d Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3595-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:sns-3615-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1i | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3615-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.1g | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3655-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1i | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3655-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.1g | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3695-k9_bios:*:*:*:*:*:*:*:* | before 4.0.1i | Vulnerable | Cisco |
| cpe:2.3:o:cisco:sns-3695-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.1g | Vulnerable | Cisco |
| cpe:2.3:o:cisco:tg5004-k9_bios:*:*:*:*:*:*:*:* | before 4.0.2d | Vulnerable | Cisco |
| cpe:2.3:o:cisco:tg5004-k9_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:o:cisco:tg5004-k9-rf_bios:*:*:*:*:*:*:*:* | before 4.0.2d | Vulnerable | Cisco |
| cpe:2.3:o:cisco:tg5004-k9-rf_firmware:*:*:*:*:*:*:*:* | before 4.0.2h | Vulnerable | Cisco |
| cpe:2.3:a:cisco:identity_services_engine:2.4\(0.357\):*:*:*:*:*:*:* | 2.4(0.357) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:identity_services_engine:2.6\(0.156\):*:*:*:*:*:*:* | 2.6(0.156) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_computing_system:3.2\(3h\)c:*:*:*:*:*:*:* | 3.2(3h)c | Vulnerable | Cisco |
- cpe:2.3:o:cisco:sns-3615-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1i Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3615-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.1g Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3655-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1i Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3655-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.1g Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3695-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.1i Vulnerable ·Cisco
- cpe:2.3:o:cisco:sns-3695-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.1g Vulnerable ·Cisco
- cpe:2.3:o:cisco:tg5004-k9_bios:*:*:*:*:*:*:*:* Versions before 4.0.2d Vulnerable ·Cisco
- cpe:2.3:o:cisco:tg5004-k9_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:o:cisco:tg5004-k9-rf_bios:*:*:*:*:*:*:*:* Versions before 4.0.2d Vulnerable ·Cisco
- cpe:2.3:o:cisco:tg5004-k9-rf_firmware:*:*:*:*:*:*:*:* Versions before 4.0.2h Vulnerable ·Cisco
- cpe:2.3:a:cisco:identity_services_engine:2.4\(0.357\):*:*:*:*:*:*:* Versions 2.4(0.357) Vulnerable ·Cisco
- cpe:2.3:a:cisco:identity_services_engine:2.6\(0.156\):*:*:*:*:*:*:* Versions 2.6(0.156) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_computing_system:3.2\(3h\)c:*:*:*:*:*:*:* Versions 3.2(3h)c Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1736
- 2026-10-03 Alias added: GHSA-pwvv-633w-65j9
Sources
- CVE-2019-1736 · CVE Program
- CVE-2019-1736 · NVD
- FIRST EPSS
- GHSA-pwvv-633w-65j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences