Vulnerability record · CVE-2019-12630 · published 2 October 2019
CVE-2019-12630: Cisco Security Manager Java deserialization allows remote command execution
Cisco · Security Manager
Cisco Security Manager deserializes user-supplied content insecurely, letting an unauthenticated remote attacker send a crafted serialized Java object to a specific listener. Successful exploitation runs arbitrary commands with the privileges of the casuser account. The flaw is critical because it is network-reachable, needs no credentials or user interaction, and yields full compromise of confidentiality, integrity and availability.
Description
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of casuser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required and a very high EPSS percentile make this a top-priority remote code execution flaw.
What it is
Cisco Security Manager deserializes user-supplied content insecurely, letting an unauthenticated remote attacker send a crafted serialized Java object to a specific listener. Successful exploitation runs arbitrary commands with the privileges of the casuser account. The flaw is critical because it is network-reachable, needs no credentials or user interaction, and yields full compromise of confidentiality, integrity and availability.
Impact
An attacker gains arbitrary command execution on the affected device under the casuser account, which can lead to full control of the Security Manager host and any data or credentials it manages.
Attack surface
Reached over the network by sending a malicious serialized Java object to a specific listener on the affected system, per the advisory. No authentication or user interaction is required (CVSS vector AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no public exploit references are provided; EPSS is high at 0.65846 (99.2nd percentile), indicating elevated likelihood of exploitation activity. The only references are duplicate Cisco vendor advisories.
What to do
- Apply the Cisco Security Manager update from advisory cisco-sa-20191002-sm-java-deserial; patch is the primary action.
- Restrict network access to the affected listener so only trusted management hosts can reach it.
- Segment Security Manager from untrusted networks and monitor for unexpected inbound connections to its service ports.
- If patching is delayed, consider disabling or blocking the vulnerable listener where operationally feasible.
- Review logs and host integrity for signs of command execution as casuser.
Detection
- Monitor network traffic and logs for serialized Java object payloads sent to Security Manager listener ports.
- Alert on unexpected process creation or command execution under the casuser account.
- Baseline and monitor inbound connections to Security Manager services for anomalous source addresses.
- Correlate Security Manager service logs with host-level process and file change telemetry.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-12630 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-12630), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
