CVE-2019-1710

A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/108007Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exrVendor Advisory
• http://www.securityfocus.com/bid/108007Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exrVendor Advisory

Published

Apr 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17093An issue was discovered in Avast antivirus before 19.8 and A…7.8
• CVE-2019-17094A Stack-based Buffer Overflow vulnerability in libbelkin_api…7.8
• CVE-2019-17095A command injection vulnerability has been discovered in the…9.8
• CVE-2019-17096A OS Command Injection vulnerability in the bootstrap stage …9.8
• CVE-2019-17098Use of hard-coded cryptographic key vulnerability in August …6.5
• CVE-2019-17099An Untrusted Search Path vulnerability in EPSecurityService.…7.8
• CVE-2019-17100An Untrusted Search Path vulnerability in bdserviceshost.exe…6.5
• CVE-2019-17101Improper Neutralization of Special Elements used in a Comman…6.7
• CVE-2019-17102An exploitable command execution vulnerability exists in the…8.1
• CVE-2019-17103An Incorrect Default Permissions vulnerability in the BDLDae…5.5
• CVE-2019-17104In Centreon VM through 19.04.3, the cookie configuration wit…7.5
• CVE-2019-17105The token generator in index.php in Centreon Web before 2.8.…5.3