← Vulnerability feed

Vulnerability record · CVE-2019-18374 · published 25 November 2019

CVE-2019-18374: Broadcom symantec critical system protection improper authentication vulnerability

Broadcom · Symantec Critical System Protection

Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.

9.8 CVSS 3.1 Critical EPSS 1.7% · top 24.1% CWE-287 · Improper authentication
9.8CVSS 3.1 base score, v2 7.5
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.symantec.com/us/en/article.SYMSA1498.html Vendor Advisory
https://support.symantec.com/us/en/article.SYMSA1498.html Vendor Advisory

Track CVE-2019-18374 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.0CVE-2014-3440Broadcom symantec critical system protection improper input validation vulnerabilityThe Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security…EPSS 3.3%8.8CVE-2015-8157Broadcom symantec critical system protection sql injection vulnerabilitySQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedd…EPSS 1.5%8.0CVE-2015-8798Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 2.4%7.6CVE-2015-8799Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 5.3%7.6CVE-2013-5016Broadcom symantec critical system protection permissions and access controls vulnerabilitySymantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to b…EPSS 2.4%7.3CVE-2015-8800Broadcom symantec critical system protection injection vulnerabilitySymantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers …EPSS 1.2%7.2CVE-2014-9226Broadcom symantec critical system protection permissions and access controls vulnerabilityThe management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.…EPSS 1.5%6.5CVE-2014-7289Broadcom symantec critical system protection sql injection vulnerabilitySQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security…EPSS 4.6%

Source: NIST National Vulnerability Database (record CVE-2019-18374), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.