CVE-2019-1746 — Improper Input Validation in Cisco IOS AND IOS XE Software

CWE-20 — Improper Input Validation4 documents4 sources

Severity

6.5MEDIUMNVD

CNA7.4

EPSS

0.1%

top 65.05%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS AND IOS XE Software Cisco IOS Cisco IOS XE

Timeline

PublishedMar 28

Latest updateMay 13

Description

A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to cr…

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5cisco/cisco_ios_and_ios_xe_software93 versions+92

▶NVDcisco/ios474 versions+473

▶NVDcisco/ios_xe93 versions+92

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

GHSA

GHSA-mmwf-5332-h99w: A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticate↗2022-05-13

▶

CVEList

Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability↗2019-03-27

▶

📋Vendor Advisories

Cisco

Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability↗2019-03-27

▶