Exploit for Cisco Prime Infrastructure Health Monitor tar file directory traversal

saint · 2019-11-25

Description

Cisco Prime Infrastructure Health Monitor directory traversal vulnerabilit

Entry point

Parameterfiles · request body

Path<host>:8082/servlet/UploadServlet

UploadServlet usage to upload a crafted tar archive that overwrites si.jsp, enabling remote code execution via directory traversal in TarArchive.

Affected software

Cisco Evolved Programmable Network Manager< 3.0.1

Cisco Network Level Service= 3.0\(0.0.83b\)

Cisco Prime Infrastructure< 3.4.1

All known vulnerabilities by product

Cisco Evolved Programmable Network Manager Cisco Prime Infrastructure

CVSS 10.0 for CVE-2019-1821

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

98.1%higher than 99.9% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2019-11-25 00:00

Last Seen:2025-06-26 10:11

Reporter:SAINT Corporation

Tags

cisco prime infrastructurehealth monitordirectory traversalvulnerabilitytar fileremote attackerarbitrary commandsupgradelinuxexploitCVE-2019-1821bid-108339

Other exploits for CVE-2019-1821

Cisco Prime Infrastructure Health Monitor tar file directory traversal

2019-11-25 SAINT CorporationSAINT

Cisco Prime Infrastructure Health Monitor tar file directory traversal

2019-11-25 SAINT CorporationSAINT

Cisco Prime Infrastructure Health Monitor HA TarArchive Directory Traversal / Remote Code Execution

2019-11-17 mr_meZDTPython

Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit)

2019-06-20 MetasploitEXPLOITDBRuby

Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Exploit

2019-06-19 metasploitZDTRuby

Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal

2019-06-19 mr_mePACKETSTORMRuby

Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution

2019-05-17 mr_meEXPLOITDBPython

Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal Remote Code Execution

2019-05-17 mr_meEXPLOITPACKPython

Exploit Code

MARKDOWN26 lines

## https://sploitus.com/exploit?id=SAINT:7CF3B90B03866D04B1F841D3807F1F1B
Added: 11/25/2019  
CVE: CVE-2019-1821  
BID: 108339  


### Background

Cisco Prime Infrastructure is a management system of wireless and wired networks. 

### Problem

A vulnerability in Cisco Prime Infrastructure Health Monitor allows a remote attacker to execute arbitrary commands by uploading a specially crafted tar file. 

### Resolution

Upgrade to Cisco Prime Infrastructure 3.4.1, 3.5, 3.6, or higher. 

### References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce   


### Platforms

Linux