CVE-2019-1750 — Improper Input Validation in Cisco IOS XE Software

CWE-20 — Improper Input ValidationCWE-3885 documents5 sources
Severity
7.4HIGHNVD
EPSS
0.1%
top 65.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 28
Latest updateJul 5

Description

A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol (CDP) packets used with the Easy Virtual Switching System. An attacker could exploit this vulnerability by sending a specially crafted CDP packet. An exploit could allow the attacker to cause the device to…

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 2.8 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_software42 versions+41
▶NVDcisco/ios_xe42 versions+41

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9rp5-fg3q-frgm: A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, a↗2022-05-13
▶
CVEList
Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service Vulnerability↗2019-03-27
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service Vulnerability↗2019-03-27
▶

📄Research Papers

1
arXiv
HuntFUZZ: Enhancing Error Handling Testing through Clustering Based Fuzzing↗2024-07-05
▶
CVE-2019-1750 — Improper Input Validation in Cisco | cvebase