CVE-2019-1757
published 2019-03-28CVE-2019-1757: A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read…
PriorityP432medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
1.05%
60.9th percentile
A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
Affected
349 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
| cisco | cisco_ios_and_ios_xe_software | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_cisco5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
vendor_cisco·2019-03-27·CVSS 5.9
CVE-2019-1757 [MEDIUM] CWE-295 Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
A
vulnerability in the Cisco Smart Call Home feature of Cisco
IOS and IOS XE Software could allow an unauthenticated, remote
attacker to gain unauthorized read access to sensitive data using an invalid
certificate.
The vulnerability is due to insufficient certificate validation by the
affected software. An attacker could exploit this vulnerability by
supplying a crafted certificate to an affected device. A successful
exploit could allow the attacker to conduct man-in-the-middle attacks to
decrypt confidential information on user connections to the affected
software.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory i
Cisco
Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1757 Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
CVE-2019-1757: Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability
A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-295, CWE-295
Bug IDs: CSCvg8
GHSA
GHSA-pqr7-9qqq-hrh5: A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthor
ghsa_unreviewed·2022-05-13
CVE-2019-1757 [MEDIUM] CWE-295 GHSA-pqr7-9qqq-hrh5: A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthor
A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-03-28
Published