Vulnerability record · CVE-2019-1935 · published 21 August 2019
CVE-2019-1935: Cisco IMC Supervisor and UCS Director default scpuser credentials allow CLI login
Cisco · Integrated Management Controller Supervisor
Cisco IMC Supervisor, UCS Director, and UCS Director Express for Big Data ship with a documented scpuser account that has an undocumented default password and incorrect permissions, and the installer does not force a password change. An unauthenticated remote attacker who knows the default credentials can log in to the CLI. This matters because the account is reachable over the network and grants command execution with database read/write access.
Description
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required, default credentials that are not forced to change, and public exploit references make this trivially exploitable and high impact.
What it is
Cisco IMC Supervisor, UCS Director, and UCS Director Express for Big Data ship with a documented scpuser account that has an undocumented default password and incorrect permissions, and the installer does not force a password change. An unauthenticated remote attacker who knows the default credentials can log in to the CLI. This matters because the account is reachable over the network and grants command execution with database read/write access.
Impact
An attacker gains CLI access as scpuser and can execute arbitrary commands with that account's privileges, including full read and write access to the system database.
Attack surface
Reachable remotely over the network via the CLI/SCP login path; no authentication is required because the attacker uses the default credentials, and no user interaction is needed per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is 0.83386 (99.664th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.
What to do
- Apply the Cisco vendor advisory fix for CVE-2019-1935 on IMC Supervisor, UCS Director, and UCS Director Express for Big Data.
- Immediately change or disable the scpuser account password on all affected systems and verify the change took effect.
- Restrict network access to the CLI/SCP management interfaces to trusted administrative networks only.
- Audit all default and documented accounts on these products and enforce credential rotation at install time.
- Monitor for authentication attempts and successful logins using the scpuser account.
Detection
- Search authentication and CLI/SCP logs for successful logins by the scpuser account, especially from unexpected source IPs.
- Alert on scpuser sessions that execute shell commands or access the database.
- Baseline normal scpuser usage and flag any login outside maintenance windows or from non-administrative networks.
- Review configuration for unchanged default scpuser credentials across the affected product instances.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-1935 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1935), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
