CVE-2019-1723 json
Cisco Common Services Platform Collector Static Credential Vulnerability
published 2019-03-13 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10280
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.8%
- EPSS 5.8% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.
Patch / fix
- Cisco Cisco Common Services Platform Collector Software 2.7.4.6, 2.8.1.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
5.82% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Cisco Cisco Common Services Platform Collector Software
Classification
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv
vendor-advisory, patch
-
securityfocus.com
/bid/107405
vdb-entry, third-party-advisory
-
info-sec.ca
/advisories/Cisco-Collector.html
third-party-advisory
Sources
- CVE List CVE-2019-1723
- NVD CVE-2019-1723
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.