Read the docs
TI-2019-01483 Aliases CVE-2019-1861GHSA-2vgx-3f92-37q8

Cisco Industrial Network Director Remote Code Execution Vulnerability

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability by authenticating to the affected system using administrator privileges and uploading an arbitrary file. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04297 91st percentileScored 2026-11-07
Fix Fixed Cisco Industrial Network Director (Cisco): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Industrial Network Directorbefore 1.6.01.6.0Patch availableCNA
  • Cisco Industrial Network Director VendorCisco Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:industrial_network_director:*:*:*:*:*:*:*:*before 1.6.0VulnerableCisco
  • cpe:2.3:a:cisco:industrial_network_director:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Industrial Network Director (Cisco) Fixed in 1.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1861
  2. 2026-10-03 Alias added: GHSA-2vgx-3f92-37q8

References

Advisory 1

  • TI-2023-06745 Cisco Industrial Network Director Command Injection Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2019-01596 Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-01503 Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability CVSS 3.0HIGH 8.8
  • TI-2023-06747 Hard-coded credentials in Cisco Industrial Network Director CVSS 3.1HIGH 8.8
  • TI-2020-03111 Cisco Industrial Network Director Denial of Service Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2019-12013 Cisco Industrial Network Director Reflected Cross-Site Scripting Vulnerability CVSS 3.1MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences