7.5
CVE-2019-1892
- EPSS 0.67%
- Published 06.07.2019 02:15:11
- Last modified 21.11.2024 04:37:37
- Source psirt@cisco.com
- Teams watchlist Login
- Open Login
A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a memory corruption on an affected device. The vulnerability is due to improper validation of HTTPS packets. An attacker could exploit this vulnerability by sending a malformed HTTPS packet to the management web interface of the affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition.
Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Sf200-24 Firmware Version < 1.4.10.6
Cisco ≫ Sf200-24p Firmware Version < 1.4.10.6
Cisco ≫ Sf200-48 Firmware Version < 1.4.10.6
Cisco ≫ Sf200-48p Firmware Version < 1.4.10.6
Cisco ≫ Sg200-18 Firmware Version < 1.4.10.6
Cisco ≫ Sg200-26 Firmware Version < 1.4.10.6
Cisco ≫ Sg200-26p Firmware Version < 1.4.10.6
Cisco ≫ Sg200-50 Firmware Version < 1.4.10.6
Cisco ≫ Sg200-50p Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10 Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10mp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10mpp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10sfp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10p Firmware Version < 1.4.10.6
Cisco ≫ Sg300-10pp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-20 Firmware Version < 1.4.10.6
Cisco ≫ Sg300-28 Firmware Version < 1.4.10.6
Cisco ≫ Sg300-28p Firmware Version < 1.4.10.6
Cisco ≫ Sg300-28pp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-28mp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-28sfp Firmware Version < 1.4.10.6
Cisco ≫ Sg300-52 Firmware Version < 1.4.10.6
Cisco ≫ Sg300-52p Firmware Version < 1.4.10.6
Cisco ≫ Sg300-52mp Firmware Version < 1.4.10.6
Cisco ≫ Sf300-08 Firmware Version < 1.4.10.6
Cisco ≫ Sf302-08 Firmware Version < 1.4.10.6
Cisco ≫ Sf302-08mp Firmware Version < 1.4.10.6
Cisco ≫ Sf302-08p Firmware Version < 1.4.10.6
Cisco ≫ Sf302-08pp Firmware Version < 1.4.10.6
Cisco ≫ Sf302-08mpp Firmware Version < 1.4.10.6
Cisco ≫ Sf300-24 Firmware Version < 1.4.10.6
Cisco ≫ Sf300-24p Firmware Version < 1.4.10.6
Cisco ≫ Sf300-24mp Firmware Version < 1.4.10.6
Cisco ≫ Sf300-24pp Firmware Version < 1.4.10.6
Cisco ≫ Sf300-48 Firmware Version < 1.4.10.6
Cisco ≫ Sf300-48p Firmware Version < 1.4.10.6
Cisco ≫ Sf300-48pp Firmware Version < 1.4.10.6
Cisco ≫ Sf500-24 Firmware Version < 1.4.10.6
Cisco ≫ Sf500-24p Firmware Version < 1.4.10.6
Cisco ≫ Sf500-24mp Firmware Version < 1.4.10.6
Cisco ≫ Sf500-48 Firmware Version < 1.4.10.6
Cisco ≫ Sf500-48p Firmware Version < 1.4.10.6
Cisco ≫ Sf500-48mp Firmware Version < 1.4.10.6
Cisco ≫ Sg500-28 Firmware Version < 1.4.10.6
Cisco ≫ Sg500-28p Firmware Version < 1.4.10.6
Cisco ≫ Sg500-28mpp Firmware Version < 1.4.10.6
Cisco ≫ Sg500-52 Firmware Version < 1.4.10.6
Cisco ≫ Sg500-52p Firmware Version < 1.4.10.6
Cisco ≫ Sg500-52mp Firmware Version < 1.4.10.6
Cisco ≫ Sg500x-24 Firmware Version < 1.4.10.6
Cisco ≫ Sg500x24mpp Firmware Version < 1.4.10.6
Cisco ≫ Sg500x-48 Firmware Version < 1.4.10.6
Cisco ≫ Sg500x-48p Firmware Version < 1.4.10.6
Cisco ≫ Sg500x-48mp Firmware Version < 1.4.10.6
Cisco ≫ Sg500xg8f8t Firmware Version < 1.4.10.6
Cisco ≫ Esw2-350g52dc Firmware Version < 1.4.10.6
Cisco ≫ Esw2-550x48dc Firmware Version < 1.4.10.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.67% | 0.689 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
| psirt@cisco.com | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.