CVE-2019-1835

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information stored in an AP. The vulnerability is due to improper sanitization of user-supplied input in specific CLI commands. An attacker could exploit this vulnerability by accessing the CLI of an affected AP with administrator privileges and issuing crafted commands that result in directory traversal. A successful exploit could allow the attacker to view system files on the affected device, which could contain sensitive information. Software versions 8.8 and 8.9 are affected.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Cisco	Cisco Aironet Access Point Software	8.8; 8.9

References

http://www.securityfocus.com/bid/108001Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-air-ap-traversalVendor Advisory
http://www.securityfocus.com/bid/108001Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-air-ap-traversalVendor Advisory

Timeline

Published: Apr 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183506.1In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of CVE-2019-183528.2Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using CVE-2019-183559.8An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.CVE-2019-183566.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).CVE-2019-183576.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).CVE-2019-183595.5A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads CVE-2019-18367.1A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow CVE-2019-183605.3In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.CVE-2019-183615.3JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.CVE-2019-183625.3JetBrains MPS before 2019.2.2 exposed listening ports to the network.CVE-2019-183635.3In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumsta CVE-2019-183649.8In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.