Details of VAR-201905-0600

ID

VAR-201905-0600

CVE

CVE-2019-1859

TITLE

Cisco Small Business Switches Authorization vulnerabilities in software

Trust: 0.8

sources: JVNDB: JVNDB-2019-004454

DESCRIPTION

A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. An attacker could exploit this vulnerability by attempting to connect to the device via SSH. A successful exploit could allow the attacker to access the configuration as an administrative user if the default credentials are not changed. There are no workarounds available; however, if client-side certificate authentication is enabled, disable it and use strong password authentication. Client-side certificate authentication is disabled by default. Cisco Small Business Switches There is an authorization vulnerability in the software.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. An attacker can exploit this issue to bypass the authentication mechanism and gain unauthorized access. This may lead to further attacks. This issue is being tracked by Cisco bugs CSCvo28588, CSCvp35704

Trust: 1.98

sources: NVD: CVE-2019-1859 // JVNDB: JVNDB-2019-004454 // BID: 108140 // VULMON: CVE-2019-1859

AFFECTED PRODUCTS

vendor:	cisco	model:	sx550x-12f	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250x-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg550x-24mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350-10mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf300-48p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-50fp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-26fp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-08	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350xg-24t	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250x-48p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf302-08	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-28mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg500-52mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg550x-24mpp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-08	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350xg-24f	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf200-24fp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg550x-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-18	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf302-08mpp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-28p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sx550x-52	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg300-10pp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250x-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg300-10sfp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350-28p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf500-24p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf550x-48p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf350-48p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-10p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf500-48	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf200-24p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-52p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250-26	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350-10p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500x-24p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf550x-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf200-48p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-48	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg550x-48mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf300-48pp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-24p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg500-28mpp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350xg-2f10	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf550x-48mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg300-28	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-52	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-26	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250-50p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500x-48p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf250-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg300-10	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-18	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250-50hp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350xg-48t	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf302-08pp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-10fp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg500xg-8f8t	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250x-24p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf250-24p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350x-24mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sx550x-24ft	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf550x-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg550x-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg200-08p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-20	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg550x-48p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500-52	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf500-48p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-24mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf250-48hp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg355-10p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350x-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf550x-24mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg550x-24p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350x-48mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg200-26p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg200-50p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-10mpp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf250-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf302-08mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf500-24	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg250-26hp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350x-48p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-50	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500x-24	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-24pp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-10mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf350-48	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sx550x-24f	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sx550x-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500-52p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf200-24	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-28pp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf300-24	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg500-28	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg500-28p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350-28	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sx550x-16ft	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-26p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350x-24p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf550x-24p	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg250-08hp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sf200-48	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-52mp	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf350-48mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg350-28mp	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg200-50	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350x-24	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg200-08	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg350-10	scope:	lt	version:	2.5.0.78	Trust: 1.0
vendor:	cisco	model:	sg500x-48	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sg300-10p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	sf302-08p	scope:	lt	version:	1.4.10.6	Trust: 1.0
vendor:	cisco	model:	200 series smart switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	250 series smart switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	350 series managed switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	350x series managed switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	500 series managed switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	small business 300 series managed switch	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	small business series stackable managed switches	scope:	eq	version:	5002.4.0.92	Trust: 0.3
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	5001.4.2.04	Trust: 0.3
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	3001.4.2.04	Trust: 0.3
vendor:	cisco	model:	small business series smart switches	scope:	eq	version:	2001.4.2.04	Trust: 0.3
vendor:	cisco	model:	series stackable managed switches	scope:	eq	version:	550x2.4.5.71	Trust: 0.3
vendor:	cisco	model:	series stackable managed switches	scope:	eq	version:	550x2.3.0.130	Trust: 0.3
vendor:	cisco	model:	series stackable managed switches	scope:	eq	version:	550x2.2.5.68	Trust: 0.3
vendor:	cisco	model:	series managed switches	scope:	eq	version:	350x2.4.5.71	Trust: 0.3
vendor:	cisco	model:	series managed switches	scope:	eq	version:	3502.4.5.71	Trust: 0.3
vendor:	cisco	model:	series managed switches	scope:	eq	version:	3502.3.0.130	Trust: 0.3
vendor:	cisco	model:	series smart switches	scope:	eq	version:	2502.4.5.71	Trust: 0.3
vendor:	cisco	model:	small business series managed switches	scope:	ne	version:	5001.4.10.6	Trust: 0.3
vendor:	cisco	model:	small business series managed switches	scope:	ne	version:	3001.4.10.6	Trust: 0.3
vendor:	cisco	model:	small business series smart switches	scope:	ne	version:	2001.4.10.6	Trust: 0.3
vendor:	cisco	model:	series stackable managed switches	scope:	ne	version:	550x2.5.0.78	Trust: 0.3
vendor:	cisco	model:	series managed switches	scope:	ne	version:	350x2.5.0.78	Trust: 0.3
vendor:	cisco	model:	series managed switches	scope:	ne	version:	3502.5.0.78	Trust: 0.3
vendor:	cisco	model:	series smart switches	scope:	ne	version:	2502.5.0.78	Trust: 0.3

sources: BID: 108140 // JVNDB: JVNDB-2019-004454 // NVD: CVE-2019-1859

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1859
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1859
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-1859
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201905-054
value:	HIGH
Trust: 0.6
VULMON:	CVE-2019-1859
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-1859
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

ykramarz@cisco.com:	CVE-2019-1859
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1859
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULMON: CVE-2019-1859 // JVNDB: JVNDB-2019-004454 // CNNVD: CNNVD-201905-054 // NVD: CVE-2019-1859 // NVD: CVE-2019-1859

PROBLEMTYPE DATA

problemtype:	CWE-285	Trust: 1.8
problemtype:	CWE-295	Trust: 1.0

sources: JVNDB: JVNDB-2019-004454 // NVD: CVE-2019-1859

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-054

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201905-054

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-004454

PATCH

title:	cisco-sa-20190501-scbv	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv	Trust: 0.8
title:	Multiple Cisco Product Authorization Issue Vulnerability Fixing Measures	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92197	Trust: 0.6
title:	Cisco: Cisco Small Business Switches Secure Shell Certificate Authentication Bypass Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190501-scbv	Trust: 0.1
title:	Threatpost	url:	https://threatpost.com/cisco-critical-nexus-9000-flaw/144290/	Trust: 0.1

sources: VULMON: CVE-2019-1859 // JVNDB: JVNDB-2019-004454 // CNNVD: CNNVD-201905-054

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1859	Trust: 2.8
db:	BID	id:	108140	Trust: 1.0
db:	JVNDB	id:	JVNDB-2019-004454	Trust: 0.8
db:	AUSCERT	id:	ESB-2019.1536	Trust: 0.6
db:	CNNVD	id:	CNNVD-201905-054	Trust: 0.6
db:	VULMON	id:	CVE-2019-1859	Trust: 0.1

sources: VULMON: CVE-2019-1859 // BID: 108140 // JVNDB: JVNDB-2019-004454 // CNNVD: CNNVD-201905-054 // NVD: CVE-2019-1859

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190501-scbv	Trust: 2.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1859	Trust: 1.4
url:	http://www.cisco.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1859	Trust: 0.8
url:	https://www.securityfocus.com/bid/108140	Trust: 0.7
url:	https://www.auscert.org.au/bulletins/80182	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/295.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://threatpost.com/cisco-critical-nexus-9000-flaw/144290/	Trust: 0.1

sources: VULMON: CVE-2019-1859 // BID: 108140 // JVNDB: JVNDB-2019-004454 // CNNVD: CNNVD-201905-054 // NVD: CVE-2019-1859

CREDITS

Katie Sexton and Jimi Sebree of Tenable Research.,Katie Sexton and Jimi Sebree of Tenable Research for reporting these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-201905-054

SOURCES

db:	VULMON	id:	CVE-2019-1859
db:	BID	id:	108140
db:	JVNDB	id:	JVNDB-2019-004454
db:	CNNVD	id:	CNNVD-201905-054
db:	NVD	id:	CVE-2019-1859

LAST UPDATE DATE

2024-11-23T22:33:55.680000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2019-1859	date:	2020-10-13T00:00:00
db:	BID	id:	108140	date:	2019-05-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-004454	date:	2019-06-03T00:00:00
db:	CNNVD	id:	CNNVD-201905-054	date:	2020-10-28T00:00:00
db:	NVD	id:	CVE-2019-1859	date:	2024-11-21T04:37:32.957

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2019-1859	date:	2019-05-03T00:00:00
db:	BID	id:	108140	date:	2019-05-01T00:00:00
db:	JVNDB	id:	JVNDB-2019-004454	date:	2019-06-03T00:00:00
db:	CNNVD	id:	CNNVD-201905-054	date:	2019-05-01T00:00:00
db:	NVD	id:	CVE-2019-1859	date:	2019-05-03T17:29:01.500