CVE-2019-1738 — Improper Input Validation in Cisco IOS AND Ios-xe Software

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.5HIGHNVD

EPSS

2.3%

top 15.08%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS AND Ios-xe Software Cisco IOS Cisco IOS XE

Timeline

PublishedMar 28

Latest updateMay 13

Description

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit these vulnerabilities by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected devic…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5cisco/cisco_ios_and_ios-xe_software56 versions+55

▶NVDcisco/ios109 versions+108

▶NVDcisco/ios_xe55 versions+54

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

GHSA

GHSA-g397-2gc8-gqqf: A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic↗2022-05-13

▶

CVEList

Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability↗2019-03-27

▶

📋Vendor Advisories

Cisco

Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerabilities↗2019-03-27

▶