CVE-2019-1842
Last modified
CVE-2019-1842 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when certain sequences of actions are processed during an SSH login event on the affected device. EPSS estimates a 1.21% chance of exploitation in the next 30 days.
Description
A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when certain sequences of actions are processed during an SSH login event on the affected device. An attacker could exploit this vulnerability by initiating an SSH session to the device with a specific sequence that presents the two usernames. A successful exploit could result in logging data misrepresentation, user enumeration, or, in certain circumstances, a command authorization bypass. See the Details section for more information.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xr Firmware | 6.1.2.tools |
| Cisco | Ios Xr Firmware | 6.1.3.tools |
| Cisco | Ios Xr Firmware | 6.2.3.tools |
| Cisco | Ios Xr Firmware | 6.4.2.tools |
References
- http://www.securityfocus.com/bid/108687Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/108687Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1842?
How severe is CVE-2019-1842?
How do I fix CVE-2019-1842?
Are you affected by CVE-2019-1842?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST