Cisco UCS Director および Cisco UCS Director Express for Big Data API 認証バイパスの脆弱性

Successful exploitation of CVE-2019-1938 grants an attacker complete control over the affected Cisco UCS Director system. This includes the ability to modify system configurations, access sensitive data, and potentially compromise other systems connected to the UCS environment. The lack of authentication required for exploitation significantly broadens the attack surface, making it a high-priority risk. The ability to execute arbitrary actions with administrator privileges mirrors the impact of a full system compromise, allowing for data exfiltration, denial of service, and further malicious activity. This vulnerability shares characteristics with other authentication bypass flaws, where improper request handling allows attackers to circumvent security controls.

Organizations heavily reliant on Cisco UCS Director for managing their data center infrastructure are at significant risk. Environments with exposed UCS Director management interfaces, particularly those lacking robust network segmentation, are especially vulnerable. Legacy UCS Director deployments running older, unpatched versions are also at heightened risk.

• cisco: Monitor UCS Director logs for failed authentication attempts followed by successful administrative actions.

Get-WinEvent -LogName Security -FilterXPath '//Event[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4625] and EventData[Data[@Name='TargetUserName']='SYSTEM']' | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)} | Format-Table TimeCreated, Message

• generic web: Monitor access logs for unusual patterns of requests to authentication endpoints, particularly those lacking proper authentication headers.

grep -i 'authentication' /var/log/apache2/access.log | grep -v '401' | sort | uniq -c | sort -nr

1. 2019-08-21Disclosure

   disclosure

2. 2019-08-21Patch

   patch

1. 予約済み2018-12-06
2. 公開日2019-08-21
3. 更新日2024-11-19
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2019-1938 is to upgrade Cisco UCS Director to version 6.7.3.0 or later. If immediate upgrading is not possible, consider implementing strict network segmentation to limit external access to the UCS Director management interface. Review and restrict API access to only authorized users and applications. Monitor network traffic for suspicious HTTP requests targeting the authentication endpoints. While a WAF may offer some protection, it is not a substitute for patching. After upgrading, verify the fix by attempting to access the management interface without authentication; successful access indicates the vulnerability persists.