CVE-2019-1594

A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times, leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).

• CWE-264
• CWE-20

• http://www.securityfocus.com/bid/107325Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nx-os-lan-authPatch, Vendor Advisory
• http://www.securityfocus.com/bid/107325Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nx-os-lan-authPatch, Vendor Advisory

Published

Mar 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15934Intesync Solismed 3.3sp has CSRF.8.8
• CVE-2019-15935Intesync Solismed 3.3sp has XSS.6.1
• CVE-2019-15936Intesync Solismed 3.3sp allows Insecure File Upload.9.8
• CVE-2019-15937Pengutronix barebox through 2019.08.1 has a remote buffer ov…
• CVE-2019-15938Pengutronix barebox through 2019.08.1 has a remote buffer ov…
• CVE-2019-15939An issue was discovered in OpenCV 4.1.0. There is a divide-b…5.9
• CVE-2019-15940Victure PC530 devices allow unauthenticated TELNET access as…9.8
• CVE-2019-15941OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may…9.8
• CVE-2019-15942FFmpeg through 4.2 has a "Conditional jump or move depends o…8.8
• CVE-2019-15943vphysics.dll in Counter-Strike: Global Offensive before 1.37…8.8
• CVE-2019-15944In Counter-Strike: Global Offensive before 8/29/2019, commun…5.3
• CVE-2019-15945OpenSC before 0.20.0-rc1 has an out-of-bounds access of an A…6.4