PT-2019-2644 · Cisco · Cisco Small Business 300 Series Managed Switches+2

Publicado 2019-07-03 · Atualizado 2019-10-09 · CVE-2019-1892

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business 200, 300, and 500 Series Managed Switches (affected versions not specified)

Description The issue is related to an improper validation of HTTPS packets in the SSL protocol implementation, which could allow a remote attacker to cause a denial of service condition by sending a malformed HTTPS packet to the management web interface of the affected device. This could result in an unexpected reload of the device.

Recommendations For Cisco Small Business 200, 300, and 500 Series Managed Switches, consider restricting access to the management web interface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-02530

CVE-2019-1892

Produtos afetados

Cisco Small Business 200 Series Managed Switches

Cisco Small Business 300 Series Managed Switches

Cisco Small Business 500 Series Managed Switches

Referências · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-memcorrupt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1892 · Nota de Segurança
• https://tools.cisco.com/security/center/publicationListing.x · Nota
• https://t.me/cvenotify/272 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-1892 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02530 · Nota de Segurança