CVE-2019-1656

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An attacker could exploit this vulnerability by sending crafted commands to the affected device. An exploit could allow the attacker to gain shell access with a nonroot user account to the underlying Linux operating system on the affected device and potentially access system configuration files with sensitive information. This vulnerability only affects console connections from CIMC. It does not apply to remote connections, such as telnet or SSH.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/106715Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-nfvis-shell-accessVendor Advisory
• http://www.securityfocus.com/bid/106715Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-nfvis-shell-accessVendor Advisory

Published

Jan 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16554A missing permission check in Jenkins Build Failure Analyzer…4.3
• CVE-2019-16555A user-supplied regular expression in Jenkins Build Failure …6.5
• CVE-2019-16556Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials …6.5
• CVE-2019-16557Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earli…6.5
• CVE-2019-16558Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL…8.2
• CVE-2019-16559A missing permission check in Jenkins WebSphere Deployer Plu…5.4
• CVE-2019-16560A cross-site request forgery vulnerability in Jenkins WebSph…8.8
• CVE-2019-16561Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows u…7.1
• CVE-2019-16562Jenkins buildgraph-view Plugin 1.8 and earlier does not esca…5.4
• CVE-2019-16563Jenkins Mission Control Plugin 0.9.16 and earlier does not e…5.4
• CVE-2019-16564Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does…5.4
• CVE-2019-16565A cross-site request forgery vulnerability in Jenkins Team C…8.8