CVE-2019-1754

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

• CWE-20
• CWE-269

• http://www.securityfocus.com/bid/107590Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-privescPatch, Vendor Advisory
• http://www.securityfocus.com/bid/107590Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-privescPatch, Vendor Advisory

Published

Mar 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17534vips_foreign_load_gif_scan_image in foreign/gifload.c in lib…8.8
• CVE-2019-17535Gila CMS through 1.11.4 allows blog-list.php XSS, in both th…6.1
• CVE-2019-17536Gila CMS through 1.11.4 allows Unrestricted Upload of a File…4.9
• CVE-2019-17537Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Travers…7.5
• CVE-2019-17538Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Travers…7.5
• CVE-2019-17539In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c al…9.8
• CVE-2019-17540ImageMagick before 7.0.8-54 has a heap-based buffer overflow…8.8
• CVE-2019-17541ImageMagick before 7.0.8-55 has a use-after-free in DestroyS…8.8
• CVE-2019-17542FFmpeg before 4.2 has a heap-based buffer overflow in vqa_de…9.8
• CVE-2019-17543LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_wri…8.1
• CVE-2019-17544libaspell.a in GNU Aspell before 0.60.8 has a stack-based bu…9.1
• CVE-2019-17545GDAL through 3.0.1 has a poolDestroy double free in OGRExpat…9.8