Lucene search

CiscoCVE-2019-1814

HistoryMay 16, 2019 - 12:29 a.m.

CVE-2019-1814

2019-05-1600:29:00

CWE-770

CWE-400

cisco

web.nvd.nist.gov

cve-2019-1814

cisco

small business

managed switches

dhcp

tftp

vulnerability

denial of service

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

52.3%

JSON

A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device.

Affected configurations

Nvd

Node

ciscosf302-08pp_firmwareRange<1.4.10.6

AND

ciscosf302-08ppMatch-

Node

ciscosf302-08mpp_firmwareRange<1.4.10.6

AND

ciscosf302-08mppMatch-

Node

ciscosg300-10pp_firmwareRange<1.4.10.6

AND

ciscosg300-10ppMatch-

Node

ciscosg300-10mpp_firmwareRange<1.4.10.6

AND

ciscosg300-10mppMatch-

Node

ciscosf300-24pp_firmwareRange<1.4.10.6

AND

ciscosf300-24ppMatch-

Node

ciscosf300-48pp_firmwareRange<1.4.10.6

AND

ciscosf300-48ppMatch-

Node

ciscosg300-28pp_firmwareRange<1.4.10.6

AND

ciscosg300-28ppMatch-

Node

ciscosf300-08_firmwareRange<1.4.10.6

AND

ciscosf300-08Match-

Node

ciscosf300-48p_firmwareRange<1.4.10.6

AND

ciscosf300-48pMatch-

Node

ciscosg300-10mp_firmwareRange<1.4.10.6

AND

ciscosg300-10mpMatch-

Node

ciscosg300-10p_firmwareRange<1.4.10.6

AND

ciscosg300-10pMatch-

Node

ciscosg300-10_firmwareRange<1.4.10.6

AND

ciscosg300-10Match-

Node

ciscosg300-28p_firmwareRange<1.4.10.6

AND

ciscosg300-28pMatch-

Node

ciscosf300-24p_firmwareRange<1.4.10.6

AND

ciscosf300-24pMatch-

Node

ciscosf302-08mp_firmwareRange<1.4.10.6

AND

ciscosf302-08mpMatch-

Node

ciscosg300-28_firmwareRange<1.4.10.6

AND

ciscosg300-28Match-

Node

ciscosf300-48_firmwareRange<1.4.10.6

AND

ciscosf300-48Match-

Node

ciscosg300-20_firmwareRange<1.4.10.6

AND

ciscosg300-20Match-

Node

ciscosf302-08p_firmwareRange<1.4.10.6

AND

ciscosf302-08pMatch-

Node

ciscosg300-52_firmwareRange<1.4.10.6

AND

ciscosg300-52Match-

Node

ciscosf300-24_firmwareRange<1.4.10.6

AND

ciscosf300-24Match-

Node

ciscosf302-08_firmwareRange<1.4.10.6

AND

ciscosf302-08Match-

Node

ciscosf300-24mp_firmwareRange<1.4.10.6

AND

ciscosf300-24mpMatch-

Node

ciscosg300-10sfp_firmwareRange<1.4.10.6

AND

ciscosg300-10sfpMatch-

Node

ciscosg300-28mp_firmwareRange<1.4.10.6

AND

ciscosg300-28mpMatch-

Node

ciscosg300-52p_firmwareRange<1.4.10.6

AND

ciscosg300-52pMatch-

Node

ciscosg300-52mp_firmwareRange<1.4.10.6

AND

ciscosg300-52mpMatch-

VendorProductVersionCPE
ciscosf302-08pp_firmware*cpe:2.3:o:cisco:sf302-08pp_firmware:*:*:*:*:*:*:*:*
ciscosf302-08pp-cpe:2.3:h:cisco:sf302-08pp:-:*:*:*:*:*:*:*
ciscosf302-08mpp_firmware*cpe:2.3:o:cisco:sf302-08mpp_firmware:*:*:*:*:*:*:*:*
ciscosf302-08mpp-cpe:2.3:h:cisco:sf302-08mpp:-:*:*:*:*:*:*:*
ciscosg300-10pp_firmware*cpe:2.3:o:cisco:sg300-10pp_firmware:*:*:*:*:*:*:*:*
ciscosg300-10pp-cpe:2.3:h:cisco:sg300-10pp:-:*:*:*:*:*:*:*
ciscosg300-10mpp_firmware*cpe:2.3:o:cisco:sg300-10mpp_firmware:*:*:*:*:*:*:*:*
ciscosg300-10mpp-cpe:2.3:h:cisco:sg300-10mpp:-:*:*:*:*:*:*:*
ciscosf300-24pp_firmware*cpe:2.3:o:cisco:sf300-24pp_firmware:*:*:*:*:*:*:*:*
ciscosf300-24pp-cpe:2.3:h:cisco:sf300-24pp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sf302-08pp_firmware	*	cpe:2.3:o:cisco:sf302-08pp_firmware::::::::
cisco	sf302-08pp	-	cpe:2.3:h:cisco:sf302-08pp:-:::::::*
cisco	sf302-08mpp_firmware	*	cpe:2.3:o:cisco:sf302-08mpp_firmware::::::::
cisco	sf302-08mpp	-	cpe:2.3:h:cisco:sf302-08mpp:-:::::::*
cisco	sg300-10pp_firmware	*	cpe:2.3:o:cisco:sg300-10pp_firmware::::::::
cisco	sg300-10pp	-	cpe:2.3:h:cisco:sg300-10pp:-:::::::*
cisco	sg300-10mpp_firmware	*	cpe:2.3:o:cisco:sg300-10mpp_firmware::::::::
cisco	sg300-10mpp	-	cpe:2.3:h:cisco:sg300-10mpp:-:::::::*
cisco	sf300-24pp_firmware	*	cpe:2.3:o:cisco:sf300-24pp_firmware::::::::
cisco	sf300-24pp	-	cpe:2.3:h:cisco:sf300-24pp:-:::::::*

Rows per page:

1-10 of 541

CNA Affected

[
  {
    "product": "Cisco Small Business 300 Series Managed Switches",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0.88"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108344

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb300sms-dhcp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

52.3%

JSON

Related for CVE-2019-1814