CVE-2019-1762 — Sensitive Information Exposure in Cisco IOS AND IOS XE Software

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.4MEDIUMNVD
EPSS
0.0%
top 93.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco IOS AND IOS XE SoftwareCisco IOSCisco IOS XE
Timeline
PublishedMar 28
Latest updateMay 13

Description

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software handles configuration updates. An attacker could exploit this vulnerability by retrieving the contents of specific memory locations of an affected device. A successful exploit could result in the disclosure…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5cisco/cisco_ios_and_ios_xe_software28 versions+27
▶NVDcisco/ios31 versions+30
▶NVDcisco/ios_xe28 versions+27

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7c6r-qvm7-wmx5: A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system↗2022-05-13
▶
CVEList
Cisco IOS and IOS XE Software Information Disclosure Vulnerability↗2019-03-28
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software Information Disclosure Vulnerability↗2019-03-27
▶
CVE-2019-1762 — Sensitive Information Exposure in Cisco | cvebase