CVE-2019-1895

CRITICAL

A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. A successful exploit could allow the attacker to watch the administrator console session or interact with it, allowing admin access to the affected device.

Published: Aug 7, 2019 Modified: Jun 17, 2026

CWE-306 CWE-306

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
cisco	enterprise_network_function_virtualization_infrastructure	* < 3.12.1

GitHub Security Advisory GHSA-4wqg-2gvp-c2c4

A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise...

References (2)

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.28%

Top 18% most likely to be exploited

Threat Score 39.9 / 100

Data Sources

NVD EPSS GitHub