CVE-2019-1664

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-287

Affected software

Vendor	Product	Versions
Cisco	Cisco HyperFlex HX-Series	>= unspecified, < 3.5(2a)

References

http://www.securityfocus.com/bid/107103Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-chn-root-accessVendor Advisory
http://www.securityfocus.com/bid/107103Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-chn-root-accessVendor Advisory

Timeline

Published: Feb 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-166407.5An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /va CVE-2019-166418.4An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.ph CVE-2019-166429.8App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.CVE-2019-166435.4An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.CVE-2019-166449.8App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.CVE-2019-166458.6An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing CVE-2019-166477.2Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.CVE-2019-1664910.0On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service CVE-2019-16656.1A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct CVE-2019-1665010.0On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket fil CVE-2019-166515.3An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protectio CVE-2019-166527.2The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.