What’s Vulnerable › Vulnerabilities

CVE-2019-1822: Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-05-16 · updated 2026-06-17
• Weakness: CWE-20

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Affected products

• Cisco Evolved Programmable Network Manager (EPNM): before 3.0.1 — fixed in 3.0.1
• Cisco Prime Infrastructure: before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Cisco Evolved Programmable Network Manager (EPNM) 3.0.1; Cisco Prime Infrastructure 3.4.1. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/108339
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce
• http://www.securityfocus.com/bid/108339
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce

Get alerted when CVE-2019-1822 or the next vulnerability affects your stack