CVE-2019-1746
high-risk
Published 2019-03-28
A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
Do I need to act?
-
0.14% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.4/10
High
ADJACENT_NETWORK
/ LOW complexity
Affected Products (20)
Affected Vendors
References (4)
Third Party Advisory
http://www.securityfocus.com/bid/107612
Third Party Advisory
http://www.securityfocus.com/bid/107612
57
/ 100
high-risk
Severity
23/34 · High
Exploitability
1/34 · Minimal
Exposure
33/34 · Critical