CVE-2019-1880: Cisco Unified Computing System BIOS Signature Bypass Vulnerability

Severity: medium (CVSS 4.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-05 · updated 2026-06-17
Weakness: CWE-345

Description

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.

Affected products

Cisco Unified Computing System Server Firmware: before 4.0\(2g\); before 3.0\(4l\); from 4.0 before 4.0\(2g\); before 4.0\(4c\) — fixed in 3.0\(4l\), 4.0\(2g\), 4.0\(4c\)

How to fix

Upgrade to a fixed version: Cisco Unified Computing System Server Firmware 3.0\(4l\), 4.0\(2g\), 4.0\(4c\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-1880 or the next vulnerability affects your stack