Read the docs
TI-2019-01557 Aliases CVE-2019-1937GHSA-6j24-rh4h-rq7f

Improper authentication in Cisco Unified Computing System Director

Priority HIGH 81CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.

Why it matters now

EPSS 0.75863 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Cisco Unified Computing System Director (Cisco): 6.7.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Unified Computing System Directorbefore 6.7.3.06.7.3.0Patch availableCNA
  • Cisco Unified Computing System Director VendorCisco Affected before 6.7.3.0 Fixed in 6.7.3.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*2.2.0.3 – 2.2.0.6VulnerableCisco
cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*6.6.0.0 – 6.6.1.0; 6.7.0.0 – 6.7.1.0VulnerableCisco
cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:*6.7(0.0.67265)VulnerableCisco
cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*3.7.0.0 – 3.7.1.0VulnerableCisco
cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:*3.6.0.0VulnerableCisco
  • cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:* Versions 2.2.0.3 – 2.2.0.6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:* Versions 6.6.0.0 – 6.6.1.0; 6.7.0.0 – 6.7.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:* Versions 6.7(0.0.67265) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:* Versions 3.7.0.0 – 3.7.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:* Versions 3.6.0.0 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Unified Computing System Director (Cisco) Fixed in 6.7.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Unified Computing System Director 6.7.3.0

    6 records Highest priority Priority CRITICAL 1 CRITICAL, 1 HIGH, 4 MEDIUM

    Other records, highest priority first

    • TI-2019-01555 Hard-coded credentials in Cisco Unified Computing System DirectorPriority CRITICAL 90
    • TI-2019-01556 Improper input validation in Cisco Unified Computing System DirectorPriority MEDIUM 61
    • TI-2019-01594 Improper authentication in Cisco Unified Computing System DirectorPriority MEDIUM 56
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1937
  2. 2026-10-03 Alias added: GHSA-6j24-rh4h-rq7f

References

Exploit 1

Advisory 2

Other 3

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-01555 Hard-coded credentials in Cisco Unified Computing System Director CVSS 3.1CRITICAL 9.8
  • TI-2019-01556 Improper input validation in Cisco Unified Computing System Director CVSS 3.1HIGH 7.2
  • TI-2019-01594 Improper authentication in Cisco Unified Computing System Director CVSS 3.0CRITICAL 9.8
  • TI-2019-01487 Cisco Integrated Management Controller Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2015-05250 The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC)… CVSS 2.0HIGH 9.4
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences