Strix
26.1K

CVE-2019-1746

UnknownEPSS 0.64%

Last modified

CVE-2019-1746 is a vulnerability of currently unknown severity. A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. EPSS estimates a 0.64% chance of exploitation in the next 30 days.

Description

A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.

Metrics

EPSS Probability
0.64%

46.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoIos12.1\(6\)ea1
CiscoIos12.1\(6\)ea1a
CiscoIos12.1\(6\)ea2
CiscoIos12.1\(6\)ea2a
CiscoIos12.1\(6\)ea2b
CiscoIos12.1\(6\)ea2c
CiscoIos12.1\(8\)ea1b
CiscoIos12.1\(8\)ea1c
CiscoIos12.1\(9\)ea1
CiscoIos12.1\(9\)ea1a
CiscoIos12.1\(9\)ea1c
CiscoIos12.1\(9\)ea1d
CiscoIos12.1\(9\)ex
CiscoIos12.1\(11\)ea1
CiscoIos12.1\(11\)ea1a
CiscoIos12.1\(12c\)ea1
CiscoIos12.1\(12c\)ea1a
CiscoIos12.1\(13\)ea1
CiscoIos12.1\(13\)ea1a
CiscoIos12.1\(13\)ea1b
CiscoIos12.1\(13\)ea1c
CiscoIos12.1\(14\)az
CiscoIos12.1\(14\)ea1
CiscoIos12.1\(14\)ea1a
CiscoIos12.1\(14\)ea1b
CiscoIos12.1\(19\)ea1
CiscoIos12.1\(19\)ea1a
CiscoIos12.1\(19\)ea1b
CiscoIos12.1\(19\)ea1c
CiscoIos12.1\(19\)ea1d
CiscoIos12.1\(20\)ea1
CiscoIos12.1\(20\)ea1a
CiscoIos12.1\(20\)ea1b
CiscoIos12.1\(20\)ea2
CiscoIos12.1\(22\)ea1
CiscoIos12.1\(22\)ea1a
CiscoIos12.1\(22\)ea1b
CiscoIos12.1\(22\)ea2
CiscoIos12.1\(22\)ea3
CiscoIos12.1\(22\)ea4
CiscoIos12.1\(22\)ea4a
CiscoIos12.1\(22\)ea5
CiscoIos12.1\(22\)ea5a
CiscoIos12.1\(22\)ea6
CiscoIos12.1\(22\)ea6a
CiscoIos12.1\(22\)ea7
CiscoIos12.1\(22\)ea8
CiscoIos12.1\(22\)ea8a
CiscoIos12.1\(22\)ea9
CiscoIos12.1\(22\)ea10

Showing 50 of 567 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-1746?
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
How severe is CVE-2019-1746?
Severity scoring for CVE-2019-1746 is pending analysis. The EPSS model estimates a 0.64% probability of exploitation in the next 30 days.
How do I fix CVE-2019-1746?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-1746?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST