CVE-2019-1937: Cisco IMC Supervisor and UCS Director authentication bypass via header validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent patch-first issue for exposed management interfaces.

What it is

The web-based management interface of Cisco IMC Supervisor, UCS Director, and UCS Director Express for Big Data fails to properly validate request headers during authentication. An unauthenticated remote attacker can send crafted requests to obtain a valid administrator session token, bypassing authentication entirely. The flaw is rated critical (CVSS 9.8) and affects management infrastructure that often controls large virtualized and bare-metal environments.

Impact

An attacker gains full administrator access to the affected device, including the ability to read and modify configuration, manage users, and execute commands. Because these products are management planes, compromise can extend to the systems they control.

Attack surface

Reachable over the network through the web-based management interface (AV:N, PR:N, UI:N). No authentication or user interaction is required; the attacker only needs network access to the management interface.

Exploitation

Public exploit code is referenced by Packet Storm and Full Disclosure, and EPSS is 0.75863 (99.5th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Apply the Cisco vendor advisory patches for IMC Supervisor, UCS Director, and UCS Director Express for Big Data immediately.
• Restrict network access to the management interface using firewalls, ACLs, or management VLANs so it is not reachable from untrusted networks.
• Rotate all administrative credentials and invalidate existing sessions after patching, since tokens may have been issued to attackers.
• Monitor and audit administrator accounts and session tokens for unexpected creation or use.
• If patching cannot be done immediately, isolate affected management interfaces behind a hardened jump host or VPN.

Detection

• Hunt web server and application logs for authentication requests with malformed or unusual headers that result in successful session creation without prior login.
• Alert on new administrator session tokens or logins from unexpected source IPs, especially outside maintenance windows.
• Monitor for post-authentication administrative actions (user creation, config changes, command execution) originating from sessions with no matching login event.
• Use network detection to flag exploit traffic patterns against the management interface paths referenced in public exploit write-ups.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.