PT-2019-1752 · Cisco · Cisco Ios

Published 2019-03-27 · Updated 2019-10-09 · CVE-2019-1758

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions on the Catalyst 6500 Series Switches (affected versions not specified)

Description The issue is related to the implementation of the 802.1X standard in Cisco IOS, specifically concerning the authentication procedure. An unauthenticated, adjacent attacker could exploit this issue to access the network prior to authentication by attempting to connect to the network on an 802.1X configured port. The vulnerability arises from how 802.1X packets are handled in the process path, potentially allowing an attacker to intermittently obtain access to the network.

Recommendations For Cisco IOS on the Catalyst 6500 Series Switches, apply the software updates released by Cisco that address this issue. As a temporary workaround, consider implementing workarounds that address this vulnerability, as suggested by Cisco.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2019-01392

CVE-2019-1758

Affected Products

Cisco Ios

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1758 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1758 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-c6500 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01392 · Security Note
• https://securityfocus.com/bid/107616 · Note
• http://securityfocus.com/bid/107616 · Note