CVE-2019-3606: Data leakage when in an MDR pair by McAfee Network Security Manager 9.x

Severity: medium (CVSS 4.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-26 · updated 2026-06-17
Weakness: CWE-312

Description

Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9.2 < 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands.

Affected products

McAfee Network Security Management (NSM): from 9.1 before 9.1.7.75; from 9.2 before 9.2.7.31 — fixed in 9.1.7.75, 9.2.7.31

How to fix

Upgrade to a fixed version: McAfee Network Security Management (NSM) 9.1.7.75, 9.2.7.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3606 or the next vulnerability affects your stack