Read the docs
TI-2019-01517 Aliases CVE-2019-1895GHSA-4wqg-2gvp-c2c4

Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability

Priority MEDIUM 53CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02304 83rd percentileScored 2026-11-07
Fix Fixed Cisco Enterprise NFV Infrastructure Software (Cisco): 3.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Enterprise NFV Infrastructure Softwarebefore 3.12.13.12.1Patch availableCNA
  • Cisco Enterprise NFV Infrastructure Software VendorCisco Affected before 3.12.1 Fixed in 3.12.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*before 3.12.1VulnerableCisco
  • cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:* Versions before 3.12.1 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Enterprise NFV Infrastructure Software (Cisco) Fixed in 3.12.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1895
  2. 2026-10-03 Alias added: GHSA-4wqg-2gvp-c2c4

References

Advisory 1

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-13745 Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-03016 Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2022-05339 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2022-05338 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2022-05336 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences