Rewterz Threat Advisory – CVE2019-1880 – Cisco Unified Computing System BIOS Signature Bypass Vulnerability

Severity

Medium

Analysis Summary

The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.

Impact

Security bypass

Affected Vendors

Cisco

Affected Products

Cisco Unified Computing System (UCS) C-Series

Remediation

Please see vendor’s advisory for more details.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ucs-biossig-bypass