CVE-2019-1662
Last modified
CVE-2019-1662 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. EPSS estimates a 1.78% chance of exploitation in the next 30 days.
Description
A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the QOVR service with a valid username. A successful exploit could allow the attacker to perform actions with the privileges of the user that is used for access. This vulnerability affects Cisco PCA Software Releases prior to 12.1 SP2.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Prime Collaboration Assurance | < 12.1 |
| Cisco | Prime Collaboration Assurance | 12.1 |
References
- http://www.securityfocus.com/bid/107096Third Party Advisory
- http://www.securityfocus.com/bid/107096Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1662?
How severe is CVE-2019-1662?
How do I fix CVE-2019-1662?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-16575A cross-site request forgery vulnerability in Jenkins Alauda…8.8
- CVE-2019-16576A missing permission check in Jenkins Alauda Kubernetes Supo…6.5
- CVE-2019-1658A vulnerability in the web-based management interface of Cis…4.7
- CVE-2019-1659A vulnerability in the Identity Services Engine (ISE) integr…7.4
- CVE-2019-1660A vulnerability in the Simple Object Access Protocol (SOAP) …5.3
- CVE-2019-1661A vulnerability in the web-based management interface of Cis…6.1
- CVE-2019-1663A vulnerability in the web-based management interface of the…9.8
- CVE-2019-16638An issue was found on the Ruijie EG-2000 series gateway. An …7.5
- CVE-2019-16639An issue was found on the Ruijie EG-2000 series gateway. The…9.8
- CVE-2019-1664A vulnerability in the hxterm service of Cisco HyperFlex Sof…7.8
- CVE-2019-16640An issue was found in upload.php on the Ruijie EG-2000 serie…7.5
- CVE-2019-16641An issue was found on the Ruijie EG-2000 series gateway. The…8.4
Are you affected by CVE-2019-1662?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST