Lucene search

CiscoCVE-2019-12655

HistorySep 25, 2019 - 9:15 p.m.

CVE-2019-12655

2019-09-2521:15:10

CWE-120

CWE-20

cisco

web.nvd.nist.gov

cve-2019-12655

vulnerability

cisco

ios xe

ftp

alg

nat

nat64

zbfw

buffer overflow

remote attacker

reload

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT IPv6 to IPv4 (NAT64), and the Zone-Based Policy Firewall (ZBFW) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a buffer overflow that occurs when an affected device inspects certain FTP traffic. An attacker could exploit this vulnerability by performing a specific FTP transfer through the device. A successful exploit could allow the attacker to cause the device to reload.

Affected configurations

Nvd

Node

ciscoiosRange3.16.8s–16.3.8

ciscoiosRange16.10.1–16.11.1

ciscoiosMatch16.6.4

ciscoiosMatch16.6.5

ciscoiosMatch16.9.1

ciscoiosMatch16.9.2

VendorProductVersionCPE
ciscoios*cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
ciscoios16.6.4cpe:2.3:o:cisco:ios:16.6.4:*:*:*:*:*:*:*
ciscoios16.6.5cpe:2.3:o:cisco:ios:16.6.5:*:*:*:*:*:*:*
ciscoios16.9.1cpe:2.3:o:cisco:ios:16.9.1:*:*:*:*:*:*:*
ciscoios16.9.2cpe:2.3:o:cisco:ios:16.9.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios	*	cpe:2.3:o:cisco:ios::::::::
cisco	ios	16.6.4	cpe:2.3:o:cisco:ios:16.6.4:::::::*
cisco	ios	16.6.5	cpe:2.3:o:cisco:ios:16.6.5:::::::*
cisco	ios	16.9.1	cpe:2.3:o:cisco:ios:16.9.1:::::::*
cisco	ios	16.9.2	cpe:2.3:o:cisco:ios:16.9.2:::::::*

CNA Affected

[
  {
    "product": "Cisco IOS XE Software 3.16.8S",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ftp

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

Related for CVE-2019-12655