Sign-up

ID

VAR-201907-0237


CVE

CVE-2019-1891


TITLE

plural Cisco Small Business Series Managed Switch Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-006440

DESCRIPTION

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This issue is being tracked by Cisco Bug IDs CSCvp43403, and CSCvp43417

Trust: 1.89

sources: NVD: CVE-2019-1891 // JVNDB: JVNDB-2019-006440 // BID: 109039

AFFECTED PRODUCTS

vendor:ciscomodel:esw2-350g52dcscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-48pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-08scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-48pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf302-08scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-28mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-24mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-52mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:esw2-550x48dcscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg200-26pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg200-50pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10mppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf302-08mppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-28pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf302-08mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-24scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10ppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10sfpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500xg8f8tscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500x-24scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-24pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-24ppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-48scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf200-24pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-52pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-52pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf200-24scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-28sfpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf200-48pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-28ppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-48scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-48ppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-24pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf300-24scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-28mppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-28scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-52scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-28scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg200-26scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-28pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500x-48mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500x-48pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf200-48scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg200-18scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-52mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf302-08ppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-48mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg200-50scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500x24mppscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf500-24mpscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500x-48scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-20scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg300-10pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf302-08pscope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sg500-52scope:ltversion:1.4.10.6

Trust: 1.0

vendor:ciscomodel:sf200-24scope: - version: -

Trust: 0.8

vendor:ciscomodel:sf200-24pscope: - version: -

Trust: 0.8

vendor:ciscomodel:sf200-48scope: - version: -

Trust: 0.8

vendor:ciscomodel:sf200-48pscope: - version: -

Trust: 0.8

vendor:ciscomodel:sg200-18scope: - version: -

Trust: 0.8

vendor:ciscomodel:sg200-26scope: - version: -

Trust: 0.8

vendor:ciscomodel:sg200-26pscope: - version: -

Trust: 0.8

vendor:ciscomodel:sg200-50scope: - version: -

Trust: 0.8

vendor:ciscomodel:sg200-50pscope: - version: -

Trust: 0.8

vendor:ciscomodel:sg300-10scope: - version: -

Trust: 0.8

vendor:ciscomodel:small business series stackable managed switchesscope:eqversion:5001.4.9.0

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:5001.4.2.04

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:3001.4.7

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:3001.4.9.0

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:3001.4.2.04

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:3001.4.0.88

Trust: 0.3

vendor:ciscomodel:small business series managed switchscope:eqversion:3001.4.8.06

Trust: 0.3

vendor:ciscomodel:small business series managed switchscope:eqversion:3001.2.7.76

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:eqversion:2001.4.2.04

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:neversion:5001.4.10.6

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:neversion:3001.4.10.6

Trust: 0.3

vendor:ciscomodel:small business series managed switchesscope:neversion:2001.4.10.6

Trust: 0.3

sources: BID: 109039 // JVNDB: JVNDB-2019-006440 // NVD: CVE-2019-1891

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1891
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1891
value: HIGH

Trust: 1.0

NVD: CVE-2019-1891
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201907-235
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2019-1891
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2019-1891
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 2.8

sources: JVNDB: JVNDB-2019-006440 // CNNVD: CNNVD-201907-235 // NVD: CVE-2019-1891 // NVD: CVE-2019-1891

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2019-006440 // NVD: CVE-2019-1891

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-235

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201907-235

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-006440

PATCH
title:cisco-sa-20190703-sbss-dosurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-dos
Trust: 0.8
title:Cisco Small Business 200 , 300  and 500 Series Managed Switches Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94424
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-006440 // 
            
            
            
            CNNVD: CNNVD-201907-235

EXTERNAL IDS
db:NVDid:CVE-2019-1891
Trust: 2.7
db:BIDid:109039
Trust: 0.9
db:JVNDBid:JVNDB-2019-006440
Trust: 0.8
db:AUSCERTid:ESB-2019.2440
Trust: 0.6
db:CNNVDid:CNNVD-201907-235
Trust: 0.6
sources:
            
            
            BID: 109039 // 
            
            
            
            JVNDB: JVNDB-2019-006440 // 
            
            
            
            CNNVD: CNNVD-201907-235 // 
            
            
            
            NVD: CVE-2019-1891

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190703-sbss-dos
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2019-1891
Trust: 1.4
url:http://www.cisco.com/
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1891
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190703-sbss-memcorrupt
Trust: 0.6
url:https://www.securityfocus.com/bid/109039
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2440/
Trust: 0.6
sources:
            
            
            BID: 109039 // 
            
            
            
            JVNDB: JVNDB-2019-006440 // 
            
            
            
            CNNVD: CNNVD-201907-235 // 
            
            
            
            NVD: CVE-2019-1891

CREDITS
Cisco
Trust: 0.9
sources:
            
            
            BID: 109039 // 
            
            
            
            CNNVD: CNNVD-201907-235

SOURCES
db:BIDid:109039
db:JVNDBid:JVNDB-2019-006440
db:CNNVDid:CNNVD-201907-235
db:NVDid:CVE-2019-1891

LAST UPDATE DATE
2024-11-23T22:48:22.054000+00:00

SOURCES UPDATE DATE
db:BIDid:109039date:2019-07-03T00:00:00
db:JVNDBid:JVNDB-2019-006440date:2019-07-19T00:00:00
db:CNNVDid:CNNVD-201907-235date:2019-07-18T00:00:00
db:NVDid:CVE-2019-1891date:2024-11-21T04:37:37.573

SOURCES RELEASE DATE
db:BIDid:109039date:2019-07-03T00:00:00
db:JVNDBid:JVNDB-2019-006440date:2019-07-19T00:00:00
db:CNNVDid:CNNVD-201907-235date:2019-07-03T00:00:00
db:NVDid:CVE-2019-1891date:2019-07-06T02:15:11.183