CVE-2019-1823: Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-16 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Affected products

Cisco Evolved Programmable Network Manager (EPNM): before 3.0.1 — fixed in 3.0.1
Cisco Network Level Service: 3.0(0.0.83b)
Cisco Prime Infrastructure: before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Cisco Evolved Programmable Network Manager (EPNM) 3.0.1; Cisco Prime Infrastructure 3.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-1823 or the next vulnerability affects your stack