// For flags

CVE-2019-1710

Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device.

Una vulnerabilidad en la máquina virtual (VM) sysadmin en ASR 9000 Series Aggregation Services Routers de Cisco ejecutándose en el software IOS XR de Cisco de 64 bits, podría permitir que un atacante remoto no autorizado acceda a las aplicaciones internas que se ejecutan en la VM sysadmin. La vulnerabilidad es debido a un aislamiento incorrecto de la interfaz de administración secundaria de las aplicaciones internas de sysadmin. Un atacante podría explotar esta vulnerabilidad al conectarse a una de las aplicaciones internas de escucha. Una explotación con éxito podría resultar en condiciones inestables, que incluyen tanto una denegación de servicio como un acceso remoto no identificado al dispositivo. Esta vulnerabilidad se ha corregido en la versión 6.5.3 y 7.0.1 del programa IOS XR de Cisco de 64 bits, que editará el archivo calvados_boostrap.cfg y recargará el dispositivo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-04-17 CVE Published
  • 2024-09-07 EPSS Updated
  • 2024-11-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Ios Xr
Search vendor "Cisco" for product "Ios Xr"
 < 6.5.3
Search vendor "Cisco" for product "Ios Xr" and version " < 6.5.3"
x64
Affected
in Cisco
Search vendor "Cisco"
 Asr 9000
Search vendor "Cisco" for product "Asr 9000"
--
Safe
Cisco
Search vendor "Cisco"
 Ios Xr
Search vendor "Cisco" for product "Ios Xr"
 >= 7.0 < 7.0.1
Search vendor "Cisco" for product "Ios Xr" and version " >= 7.0 < 7.0.1"
x64
Affected
in Cisco
Search vendor "Cisco"
 Asr 9000
Search vendor "Cisco" for product "Asr 9000"
--
Safe