CVE-2019-1815

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2019-1815", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2018-12-06T00:00:00.000Z", "datePublished": "2025-03-04T18:14:41.026Z", "dateUpdated": "2025-03-04T18:29:27.408Z"}, "containers": {"cna": {"title": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "A security vulnerability was discovered in the local status page functionality of Cisco Meraki\u2019s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device."}], "references": [{"url": "https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability", "name": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability"}], "exploits": [{"lang": "en", "value": "As of this publication date, Cisco Meraki is NOT aware of any active exploitation of this vulnerability, nor the public availability of any tool to exploit this vulnerability, nor details on how to exploit this vulnerability."}], "source": {"advisory": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_0", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "type": "cwe", "cweId": "CWE-200"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Meraki MX Firmware", "versions": [{"version": "N/A", "status": "affected"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-04T18:14:41.026Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T18:29:15.690942Z", "id": "CVE-2019-1815", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T18:29:27.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-1815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T18:29:15.690942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T18:29:22.958Z"}}], "cna": {"title": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability", "source": {"advisory": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_0", "cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Meraki MX Firmware", "versions": [{"status": "affected", "version": "N/A"}]}], "exploits": [{"lang": "en", "value": "As of this publication date, Cisco Meraki is NOT aware of any active exploitation of this vulnerability, nor the public availability of any tool to exploit this vulnerability, nor details on how to exploit this vulnerability."}], "references": [{"url": "https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability", "name": "Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability"}], "descriptions": [{"lang": "en", "value": "A security vulnerability was discovered in the local status page functionality of Cisco Meraki\u2019s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-04T18:14:41.026Z"}}}, "cveMetadata": {"cveId": "CVE-2019-1815", "state": "PUBLISHED", "dateUpdated": "2025-03-04T18:29:27.408Z", "dateReserved": "2018-12-06T00:00:00.000Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-03-04T18:14:41.026Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco Meraki MX Firmware", "vendor": "Cisco", "versions": [{"status": "affected", "version": "N/A"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability was discovered in the local status page functionality of Cisco Meraki\u2019s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de seguridad en la funcionalidad de la p\u00e1gina de estado local de los modelos de dispositivos de seguridad MX67 y MX68 de Cisco Meraki que puede permitir que personas no autenticadas accedan y descarguen registros que contienen informaci\u00f3n confidencial y privilegiada del dispositivo. La vulnerabilidad se debe a un control de acceso inadecuado a los archivos que contienen informaci\u00f3n de depuraci\u00f3n y mantenimiento, y solo se puede explotar cuando la p\u00e1gina de estado local est\u00e1 habilitada en el dispositivo. Un atacante que aproveche esta vulnerabilidad puede obtener acceso a claves precompartidas inal\u00e1mbricas, claves de VPN de sitio a sitio y otra informaci\u00f3n confidencial. En determinadas circunstancias, esta informaci\u00f3n puede permitir que un atacante obtenga acceso de nivel administrativo al dispositivo."}], "id": "CVE-2019-1815", "lastModified": "2026-06-17T02:29:22.407", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-1815", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-04T18:29:15.690942Z", "version": "2.0.3"}}]}, "published": "2025-03-04T19:15:36.177", "references": [{"source": "psirt@cisco.com", "url": "https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T23:06:19.847021+00:00", "updated": "2025-07-12T23:06:19.847067+00:00", "vendors": ["cisco", "cisco$PRODUCT$meraki_mx_firmware"]}