cbcvebase.
CVE-2019-12693
published 2019-10-02

CVE-2019-12693: A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a…

PriorityP423medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
1.49%
71.2th percentile
A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to the use of an incorrect data type for a length variable. An attacker could exploit this vulnerability by initiating the transfer of a large file to an affected device via SCP. To exploit this vulnerability, the attacker would need to have valid privilege level 15 credentials on the affected device. A successful exploit could allow the attacker to cause the length variable to roll over, which could cause the affected device to crash.

Affected

7 ranges
VendorProductVersion rangeFixed in
ciscoadaptive_security_appliance< 9.6.4.309.6.4.30
ciscoadaptive_security_appliance
ciscoadaptive_security_appliance_software>= 9.10 < 9.10.1.229.10.1.22
ciscoadaptive_security_appliance_software>= 9.12 < 9.12.2.19.12.2.1
ciscoadaptive_security_appliance_software>= 9.7 < 9.8.49.8.4
ciscoadaptive_security_appliance_software>= 9.9 < 9.9.2.509.9.2.50
ciscocisco_adaptive_security_appliance_software>= unspecified < n/an/a

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv3.06.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
vendor_cisco6.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.