CVE-2019-1698
Cisco IoT Field Network Director XML External Entity Vulnerability
- Published
- Feb 21, 2019
- Updated
- Nov 21, 2024
- Assigning CNA
- cisco
- Evidence observed
- Aug 4, 2026
Primary CVSS
nvd · CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NLow · next 30 days
- Percentile
- 87.2%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.
Sources
1- CVE-2019-1698Research
Step-by-step technical analysis of CVE-2019-1698, a WordPress plugin SQL injection vulnerability, with code diff review, vulnerable function identification, and exploitation demonstration using curl.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.