Lucene search

CiscoCVE-2019-12653

HistorySep 25, 2019 - 9:15 p.m.

CVE-2019-12653

2019-09-2521:15:10

CWE-20

cisco

web.nvd.nist.gov

cisco

ios

xe software

vulnerability

dos

nvd

cve-2019-12653

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

A vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper parsing of Raw Socket Transport payloads. An attacker could exploit this vulnerability by establishing a TCP session and then sending a malicious TCP segment via IPv4 to an affected device. This cannot be exploited via IPv6, as the Raw Socket Transport feature does not support IPv6 as a network layer protocol.

Affected configurations

Nvd

Node

ciscoios_xeMatch16.9

ciscoios_xeMatch16.10.1

AND

ciscoasr_902Match-

ciscoasr_902uMatch-

ciscoasr_903Match-

ciscoasr_907Match-

ciscoasr_914Match-

VendorProductVersionCPE
ciscoios_xe16.9cpe:2.3:o:cisco:ios_xe:16.9:*:*:*:*:*:*:*
ciscoios_xe16.10.1cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*
ciscoasr_902-cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:*
ciscoasr_902u-cpe:2.3:h:cisco:asr_902u:-:*:*:*:*:*:*:*
ciscoasr_903-cpe:2.3:h:cisco:asr_903:-:*:*:*:*:*:*:*
ciscoasr_907-cpe:2.3:h:cisco:asr_907:-:*:*:*:*:*:*:*
ciscoasr_914-cpe:2.3:h:cisco:asr_914:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	16.9	cpe:2.3:o:cisco:ios_xe:16.9:::::::*
cisco	ios_xe	16.10.1	cpe:2.3:o:cisco:ios_xe:16.10.1:::::::*
cisco	asr_902	-	cpe:2.3:h:cisco:asr_902:-:::::::*
cisco	asr_902u	-	cpe:2.3:h:cisco:asr_902u:-:::::::*
cisco	asr_903	-	cpe:2.3:h:cisco:asr_903:-:::::::*
cisco	asr_907	-	cpe:2.3:h:cisco:asr_907:-:::::::*
cisco	asr_914	-	cpe:2.3:h:cisco:asr_914:-:::::::*

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-rawtcp-dos

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

Related for CVE-2019-12653