WaratekVRT Sign in

CVE-2019-1821 Cisco Prime Infrastructure

Affected softwareCisco Prime Infrastructure
Severity9.8 Critical CVSS 3.0 3 scores
WeaknessImproper input validation (CWE-20)
Published16 May 2019
Updated17 Jun 2026

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · honeypot sightings · 2 exploits · earliest 2023-11-15.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 5 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2019-05-17.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-1821 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 753 days 2023-11-15 to 2026-11-12
Reported exploitation info.greynoise.io /hubfs/resources/GreyNoise-Early-Warning-Signals-Attacker-Behavior-Precedes-New-Vulnerabilities-Report.pdf 2025-07-31
Reported exploitation greynoise.io /blog/scanning-surge-cisco-asa-devices 2025-09-04
Exploit reference VulnCheck XDB 423b1aa3640c Exploit type: initial-access 2022-07-05
Exploit reference VulnCheck XDB af7753f2b014 Exploit type: initial-access 2023-12-21
IndexArtifactStarsFirst seen
GitHub PoC Cisco Exploit (CVE-2019-1821 Cisco Prime Infrastructure Remote Code Execution/CVE-2019-1653/Cisco SNMP RCE/Dump Cisco RV320 Password) 144 2019-05-21
Exploit-DB Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit) 2019-06-20
Exploit-DB Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution 2019-05-17
Metasploit Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability (excellent rank)
Nuclei Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H psirt@cisco.com Secondary
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd cisco evolved programmable network manager generic ＜ 3.0.1
nvd cisco network level service generic 3.0\(0.0.83b\)
nvd cisco prime infrastructure generic ＜ 3.4.1

References

URLTags
http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html
http://www.securityfocus.com/bid/108339 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce Vendor Advisory

Timeline
Published2019-05-16By the CVE Program.
VulnCheck KEV: earliest evidence2023-11-15Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-12Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.