Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-1978 — Improper Input Validation in Cisco Firepower Threat Defense Software

CWE-264CWE-20 — Improper Input Validation5 documents5 sources
Severity
5.8MEDIUMNVD
EPSS
40.2%
top 2.65%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Cisco Firepower Threat Defense SoftwareCisco Secure Firewall Management Center
Timeline
PublishedNov 5
Latest updateMay 24

Description

A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper reassembly of traffic streams. An attacker could exploit this vulnerability by sending crafted streams through an affected device. An exploit could allow the attacker to bypass filtering and delive…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5cisco/cisco_firepower_threat_defense_softwareunspecified — n/a
▶NVDcisco/secure_firewall_management_center2.9.12 — 2.9.12.15+4

🔴Vulnerability Details

2
GHSA
GHSA-9jmf-g2f7-v2ph: A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Fi↗2022-05-24
▶
CVEList
Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability↗2019-11-05
▶

💥Exploits & PoCs

1
Exploit-DB
Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution↗2020-01-11
▶

📋Vendor Advisories

1
Cisco
Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability↗2019-08-16
▶
CVE-2019-1978 — Improper Input Validation in Cisco | cvebase