Security readout for executives and security teams
Plain-English summary
ADTRAN PMAA had an access-control failure that could let a low-privileged user become highly privileged and run commands. For affected deployments, this is a serious administrative-plane risk because management access could become system control. The sources do not provide CVSS, patch details, or evidence of exploitation.
Executive priority
Treat this as high priority if affected PMAA versions are in use. The business concern is administrative takeover of a network management platform, but urgency should be balanced by actual exposure, user access, and vendor remediation guidance.
Technical view
CVE-2018-19648 affects ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. The issue is in NETCONF Access Management behavior: unprivileged users can create privileged users and execute arbitrary commands through diagnostic-profile use over RESTCONF. Public metadata does not list CWE, CVSS, CPEs, or remediation details.
Likely exposure
Exposure is most likely where ADTRAN PMAA 1.6.2-1, 1.6.3, or 1.6.4 is deployed and RESTCONF management access is reachable by non-administrative users. The bundle does not identify other affected products or configurations.
Exploitation context
The CVE description states privilege creation and arbitrary command execution are possible, but the bundle provides no exploit code, exploitation reports, or proof of active exploitation. It is not listed as CISA KEV in the supplied data.
Researcher notes
The public record is sparse: no CVSS, CWE, CPE, or patch version is included in the provided bundle. Analysis should avoid expanding scope beyond ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4 until vendor documentation confirms details.
Mitigation direction
- Identify any ADTRAN PMAA 1.6.2-1, 1.6.3, or 1.6.4 deployments.
- Review ADTRAN DOC-9344 for vendor-confirmed remediation or workaround guidance.
- Limit RESTCONF management access to trusted administrative networks and users.
- Review PMAA accounts for unexpected privileged users or recent privilege changes.
- Prioritize upgrade or compensating controls if vendor guidance confirms no supported fix.
Validation and detection
- Inventory PMAA versions and confirm whether affected versions are present.
- Verify RESTCONF exposure and whether non-admin users can reach management functions.
- Audit user creation and privilege assignment logs for suspicious activity.
- Check configuration for diagnostic-profile access by unprivileged roles.
- Document vendor advisory status and any remediation decision.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-19648 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://supportforums.adtran.com/docs/DOC-9344CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.