PT-2019-2644 · Cisco · Cisco Small Business 300 Series Managed Switches+2

Published 2019-07-03 · Updated 2019-10-09 · CVE-2019-1892

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business 200, 300, and 500 Series Managed Switches (affected versions not specified)

Description The issue is related to an improper validation of HTTPS packets in the SSL protocol implementation, which could allow a remote attacker to cause a denial of service condition by sending a malformed HTTPS packet to the management web interface of the affected device. This could result in an unexpected reload of the device.

Recommendations For Cisco Small Business 200, 300, and 500 Series Managed Switches, consider restricting access to the management web interface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-02530

CVE-2019-1892

Affected Products

Cisco Small Business 200 Series Managed Switches

Cisco Small Business 300 Series Managed Switches

Cisco Small Business 500 Series Managed Switches

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-memcorrupt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1892 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1892 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02530 · Security Note
• https://tools.cisco.com/security/center/publicationListing.x · Note
• https://t.me/cvenotify/272 · Telegram Post