CVE-2019-16027 - Vulnerability Details

CVE-2019-16027 - Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service Vulnerability

A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition in the IS–IS process. The vulnerability is due to improper handling of a Simple Network Management Protocol (SNMP) request for specific Object Identifiers (OIDs) by the IS–IS process. An attacker could exploit this vulnerability by sending a crafted SNMP request to the affected device. A successful exploit could allow the attacker to cause a DoS condition in the IS–IS process.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01067.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco IOS XR Software

affected

Version	Status	Constraints
`unspecified`	affected	< n/a

Configuration 1 [-]

AND

cpe:2.3:o:cisco:ios_xr:4.3.2:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:xr_12404:-:::::::*
	cpe:2.3:h:cisco:xr_12406:-:::::::*
	cpe:2.3:h:cisco:xr_12410:-:::::::*
	cpe:2.3:h:cisco:xr_12416:-:::::::*

Configuration 2 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:5.2.5:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.25:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.4.2:::::::*

OR	cpe:2.3:h:cisco:ncs_6000:-:::::::*
	cpe:2.3:h:cisco:ncs_6008:-:::::::*

Configuration 3 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.1.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.1.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.25:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.4.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*

OR	cpe:2.3:h:cisco:ncs_5001:-:::::::*
	cpe:2.3:h:cisco:ncs_5002:-:::::::*
	cpe:2.3:h:cisco:ncs_5011:-:::::::*

Configuration 4 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.1.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.1.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.15:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.25:::::::*

OR	cpe:2.3:h:cisco:ncs_5500:-:::::::*
	cpe:2.3:h:cisco:ncs_5501:-:::::::*
	cpe:2.3:h:cisco:ncs_5502:-:::::::*
	cpe:2.3:h:cisco:ncs_5508:-:::::::*
	cpe:2.3:h:cisco:ncs_5516:-:::::::*

Configuration 5 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.1.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.4.2:::::::*

cpe:2.3:h:cisco:crs:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.1.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.4.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.2:::::::*

cpe:2.3:h:cisco:xrv_9000:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.25:::::::*

cpe:2.3:h:cisco:ncs_540:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

OR	cpe:2.3:o:cisco:ios_xr:6.1.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.1.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.1.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.2.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.4.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.2:::::::*

OR	cpe:2.3:h:cisco:asr_9000:-:::::::*
	cpe:2.3:h:cisco:asr_9000v:v2:::::::*
	cpe:2.3:h:cisco:asr_9001:-:::::::*
	cpe:2.3:h:cisco:asr_9006:-:::::::*
	cpe:2.3:h:cisco:asr_9010:-:::::::*
	cpe:2.3:h:cisco:asr_9901:-:::::::*
	cpe:2.3:h:cisco:asr_9903:-:::::::*
	cpe:2.3:h:cisco:asr_9904:-:::::::*
	cpe:2.3:h:cisco:asr_9906:-:::::::*
	cpe:2.3:h:cisco:asr_9910:-:::::::*
	cpe:2.3:h:cisco:asr_9912:-:::::::*
	cpe:2.3:h:cisco:asr_9920:-:::::::*
	cpe:2.3:h:cisco:asr_9922:-:::::::*

No data.

Project Subscriptions

Vendors	Products
Cisco Subscribe	Asr 9000 Subscribe Asr 9000v Subscribe Asr 9001 Subscribe Asr 9006 Subscribe Asr 9010 Subscribe Asr 9901 Subscribe Asr 9903 Subscribe Asr 9904 Subscribe Asr 9906 Subscribe Asr 9910 Subscribe Asr 9912 Subscribe Asr 9920 Subscribe Asr 9922 Subscribe Crs Subscribe Ios Xr Subscribe Ncs 5001 Subscribe Ncs 5002 Subscribe Ncs 5011 Subscribe Ncs 540 Subscribe Ncs 5500 Subscribe Ncs 5501 Subscribe Ncs 5502 Subscribe Ncs 5508 Subscribe Ncs 5516 Subscribe Ncs 560 Subscribe Ncs 6000 Subscribe Ncs 6008 Subscribe Xr 12404 Subscribe Xr 12406 Subscribe Xr 12410 Subscribe Xr 12416 Subscribe Xrv 9000 Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2019-6916	A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition in the IS–IS process. The vulnerability is due to improper handling of a Simple Network Management Protocol (SNMP) request for specific Object Identifiers (OIDs) by the IS–IS process. An attacker could exploit this vulnerability by sending a crafted SNMP request to the affected device. A successful exploit could allow the attacker to cause a DoS condition in the IS–IS process.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-dos

History

Fri, 15 Nov 2024 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2020-01-26T04:31:08.495973Z

Updated: 2024-11-15T17:46:10.927Z

Reserved: 2019-09-06T00:00:00

Link: CVE-2019-16027

Vulnrichment

Updated: 2024-08-05T01:03:32.808Z

NVD

Status : Modified

Published: 2020-01-26T05:15:16.677

Modified: 2024-11-21T04:29:57.407

Link: CVE-2019-16027

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-20

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object