CVE-2019-1654 (CNNVD-201904-833)
中文标题:
多款Cisco产品访问控制错误漏洞
英文标题:
Cisco Aironet Series Access Points Development Shell Access Vulnerability
漏洞描述
中文描述:
Cisco Aironet 1540 Series APs等都是美国思科（Cisco）公司的产品。Cisco Aironet 1540 Series APs是一款1540系列访问接入点产品。Cisco Aironet 1560 Series APs是一款1560系列访问接入点产品。Cisco Aironet 1800 Series APs是一款1800系列访问接入点产品。 多款Cisco产品中的development shell(devshell)身份验证存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利用默认密码或者硬编码密码、硬编码证书等攻击受影响组件。以下产品受到影响：Cisco Aironet 1540 SeriesAPs；Aironet 1560 Series APs；Aironet 1800 Series APs；Aironet 2800 Series APs；Aironet 3800 Series APs。
英文描述:
A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authentication, which allows for root access to the underlying Linux OS. The attacker would need valid device credentials. The vulnerability exists because the software improperly validates user-supplied input at the CLI authentication prompt for development shell access. An attacker could exploit this vulnerability by authenticating to the device and entering crafted input at the CLI. A successful exploit could allow the attacker to access the AP development shell without proper authentication, which allows for root access to the underlying Linux OS. Software versions prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 are affected.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Aironet Access Point Software | - | < 8.3.150.0 | - |
cpe:2.3:a:cisco:cisco_aironet_access_point_software:*:*:*:*:*:*:*:*
|
| cisco | ap-cos | * | - | - |
cpe:2.3:o:cisco:ap-cos:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.0 (cna)
HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1654 |
2025-11-11 15:20:08 | 2025-11-11 07:35:37 |
| NVD | nvd_CVE-2019-1654 |
2025-11-11 14:56:21 | 2025-11-11 07:44:08 |
| CNNVD | cnnvd_CNNVD-201904-833 |
2025-11-11 15:10:11 | 2025-11-11 07:54:29 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201904-833
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']