Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability
Priority MEDIUM 57CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0534 92nd percentileScored 2026-11-07
Fix Fixed Cisco Vision Dynamic Signage Director (Cisco): 6.1sp3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Vision Dynamic Signage Director | before 6.1sp3 | 6.1sp3 | Patch available | CNA |
- Cisco Vision Dynamic Signage Director VendorCisco Affected before 6.1sp3 Fixed in 6.1sp3 Patch available CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:* | up to 5.0; 6.0 – 6.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp1:*:*:*:*:*:* | 5.0 sp1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp2:*:*:*:*:*:* | 5.0 sp2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp3:*:*:*:*:*:* | 5.0 sp3 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp4:*:*:*:*:*:* | 5.0 sp4 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp5:*:*:*:*:*:* | 5.0 sp5 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp6:*:*:*:*:*:* | 5.0 sp6 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp7:*:*:*:*:*:* | 5.0 sp7 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp8:*:*:*:*:*:* | 5.0 sp8 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp1:*:*:*:*:*:* | 6.1 sp1 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:* Versions up to 5.0; 6.0 – 6.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp1:*:*:*:*:*:* Versions 5.0 sp1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp2:*:*:*:*:*:* Versions 5.0 sp2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp3:*:*:*:*:*:* Versions 5.0 sp3 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp4:*:*:*:*:*:* Versions 5.0 sp4 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp5:*:*:*:*:*:* Versions 5.0 sp5 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp6:*:*:*:*:*:* Versions 5.0 sp6 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp7:*:*:*:*:*:* Versions 5.0 sp7 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp8:*:*:*:*:*:* Versions 5.0 sp8 Vulnerable ·Cisco
- cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp1:*:*:*:*:*:* Versions 6.1 sp1 Vulnerable ·Cisco
Remediation
- Fix · CNA Cisco Vision Dynamic Signage Director (Cisco) Fixed in 6.1sp3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1917
- 2026-10-03 Alias added: GHSA-q69m-6hqq-2968
References
More Cisco Vision Dynamic Signage Director vulnerabilities
- TI-2020-03138 Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2019-12043 Cisco Vision Dynamic Signage Director Authentication Bypass Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2020-03030 Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability CVSS 3.1MEDIUM 5.3
- TI-2021-13741 Cisco Vision Dynamic Signage Director Reflected Cross-Site Scripting Vulnerability CVSS 3.1MEDIUM 6.1
- TI-2020-03031 Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability CVSS 3.1MEDIUM 6.3
- TI-2020-03036 Cisco Vision Dynamic Signage Director Path Traversal Vulnerability CVSS 3.1MEDIUM 4.9
Sources
- CVE-2019-1917 · CVE Program
- CVE-2019-1917 · NVD
- FIRST EPSS
- GHSA-q69m-6hqq-2968 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences