CVE-2019-1736

A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improper validation of the server firmware upgrade images. An attacker could exploit this vulnerability by installing a server firmware version that would allow the attacker to disable UEFI Secure Boot. A successful exploit could allow the attacker to bypass the signature validation checks that are done by UEFI Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.

• CWE-347
• CWE-347

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-ucs-boot-bypassPatch, Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-ucs-boot-bypassPatch, Vendor Advisory

Published

Sep 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17354wan.htm page on Zyxel NBG-418N v2 with firmware version V1.0…9.4
• CVE-2019-17355In the Orbitz application 19.31.1 for Android, the username …9.8
• CVE-2019-17356The Infinite Design application 3.4.12 for Android sends a u…6.5
• CVE-2019-17357Cacti through 1.2.7 is affected by a graphs.php?template_id=…6.5
• CVE-2019-17358Cacti through 1.2.7 is affected by multiple instances of lib…8.1
• CVE-2019-17359The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 …7.5
• CVE-2019-17360A vulnerability in Hitachi Command Suite 7.x and 8.x before …7.5
• CVE-2019-17361In SaltStack Salt through 2019.2.0, the salt-api NET API wit…9.8
• CVE-2019-17362In LibTomCrypt through 1.18.2, the der_decode_utf8_string fu…9.1
• CVE-2019-17364The processCommandUploadLog() function of libcommon.so in Pe…9.8
• CVE-2019-17365Nix through 2.3 allows local users to gain access to an arbi…7.8
• CVE-2019-17366Citrix Application Delivery Management (ADM) 12.1 before bui…8.8