CVE-2019-1746
published 2019-03-28CVE-2019-1746: A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated…
PriorityP427medium6.5CVSS 3.0
AVAACLPRNUINSUCNINAH
EPSS
0.64%
46.9th percentile
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
Affected
661 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.1MEDIUMAV:A/AC:L/Au:N/C:N/I:N/A:C
vendor_cisco7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mmwf-5332-h99w: A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticate
ghsa_unreviewed·2022-05-13
CVE-2019-1746 [MEDIUM] CWE-20 GHSA-mmwf-5332-h99w: A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticate
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
Cisco
Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
vendor_cisco·2019-03-27·CVSS 7.4
CVE-2019-1746 [HIGH] CWE-20 Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device.
The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advi
Cisco
Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1746 Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
CVE-2019-1746: Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: C
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-03-28
Published