// For flags

CVE-2019-1595

Cisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of Service Vulnerability

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an incorrect allocation of an internal interface index. An adjacent attacker with the ability to submit a crafted FCoE packet that crosses affected interfaces could trigger this vulnerability. A successful exploit could allow the attacker to cause a packet loop and high throughput on the affected interfaces, resulting in a DoS condition. This vulnerability has been fixed in version 7.3(5)N1(1).

Una vulnerabilidad en la implementación del protocolo Fibre Channel over Ethernet (FCoE) en el software NX-OS de Cisco podría permitir a un atacante adyacente sin autenticar provocar una condición de denegación de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad se debe a una asignación incorrecta de un índice de interfaz interno. Un atacante adyacente capacitado para enviar un paquete FCoE manipulado que cruzase las interfaces afectadas podría provocar esta vulnerabilidad. Si se explota esta vulnerabilidad con éxito, un atacante podría provocar un bucle de paquete y un throughput alto en los dispositivos afectados, conduciendo a una condición DoS. Esta vulnerabilidad se ha solucionado en la versión 7.3(5)N1(1).

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-03-06 CVE Published
  • 2024-07-27 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-913: Improper Control of Dynamically-Managed Code Resources
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Nx-os
Search vendor "Cisco" for product "Nx-os"
 < 7.3\(5\)n1\(1\)
Search vendor "Cisco" for product "Nx-os" and version " < 7.3\(5\)n1\(1\)"
-
Affected
in Cisco
Search vendor "Cisco"
 Nexus 5600
Search vendor "Cisco" for product "Nexus 5600"
--
Safe
Cisco
Search vendor "Cisco"
 Nx-os
Search vendor "Cisco" for product "Nx-os"
 < 7.3\(5\)n1\(1\)
Search vendor "Cisco" for product "Nx-os" and version " < 7.3\(5\)n1\(1\)"
-
Affected
in Cisco
Search vendor "Cisco"
 Nexus 6000
Search vendor "Cisco" for product "Nexus 6000"
--
Safe