PT-2019-2354 · Cisco · Cisco Ios Xr

Publicado 2019-06-05 · Atualizado 2020-10-16 · CVE-2019-1842

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A logic error in the Secure Shell (SSH) authentication function could allow an authenticated, remote attacker to log in to an affected device using two distinct usernames. This error occurs when certain sequences of actions are processed during an SSH login event. An attacker could exploit this by initiating an SSH session with a specific sequence that presents the two usernames, potentially resulting in logging data misrepresentation, user enumeration, or a command authorization bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Improper Authentication

Enumeração de Fraquezas

CWE-285

CWE-287

Identificadores relacionados

BDU:2019-02129

CVE-2019-1842

Produtos afetados

Cisco Ios Xr

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1842 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-iosxr-ssh · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02129 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1842 · Aviso do Fabricante
• http://securityfocus.com/bid/108687 · Nota