How severe is CVE-2019-1629?

CVE-2019-1629 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2019-1629 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-1629?

CVE-2019-1629 primarily affects Cisco Integrated Management Controller. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-1629?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-1629 published?

CVE-2019-1629 was published on 2019-06-20 and last updated on 2026-06-17.

CVE-2019-1629

CVE-2019-1629 is a medium-severity vulnerability in Cisco Integrated Management Controller with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-306
Affected product: Cisco Integrated Management Controller
Published: 2019-06-20
Last modified: 2026-06-17

Description

A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.

Frequently asked questions

What is CVE-2019-1629?: A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.
How severe is CVE-2019-1629?: CVE-2019-1629 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2019-1629 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-1629?: CVE-2019-1629 primarily affects Cisco Integrated Management Controller. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-1629?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-1629 published?: CVE-2019-1629 was published on 2019-06-20 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:cisco:integrated_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_computing_system:4.0\(1c\)hs3:*:*:*:*:*:*:*

More vulnerabilities in Cisco Integrated Management Controller

CVE-2020-3470 — Critical (CVSS 9.8): Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an…
CVE-2019-1627 — Medium (CVSS 6.5): A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated,…
CVE-2018-15447 — Medium (CVSS 6.5): A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an…
CVE-2019-1879 — Medium (CVSS 6.4): A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker…
CVE-2020-3371 — Medium (CVSS 6.3): A vulnerability in the web UI of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote…
CVE-2019-1630 — Medium (CVSS 5.5): A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow…

All CVEs affecting Cisco Integrated Management Controller →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-63692 — Critical (CVSS 10.0): Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function…
CVE-2026-63688 — Critical (CVSS 10.0): Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical…
CVE-2026-103956 — Critical (CVSS 10.0): Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed…
CVE-2026-53988 — Critical (CVSS 10.0): Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows…
CVE-2026-85889 — Critical (CVSS 10.0): Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges…
CVE-2026-92808 — Critical (CVSS 10.0): A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →