Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability

published 2025-03-04 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2019-10372

cvss: 7.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 20 mo ago (2025-03-04)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Cisco Cisco Meraki MX Firmware

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

documentation.meraki.com /General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulne

Sources

CVE List CVE-2019-1815
NVD CVE-2019-1815

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary