CVE-2019-1867: Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-10 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.

Affected products

Cisco Elastic Services Controller: from 4.1 before 4.5 — fixed in 4.5

How to fix

Upgrade to a fixed version: Cisco Elastic Services Controller 4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-1867 or the next vulnerability affects your stack