PT-2019-3069 · Cisco · Cisco Ios Xr

Published 2019-08-07 · Updated 2023-03-03 · CVE-2019-1910

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software versions prior to Release 6.6.3

Description A vulnerability in the implementation of the Intermediate System-to-Intermediate System (IS-IS) routing protocol functionality could allow an unauthenticated attacker who is in the same IS-IS area to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of crafted IS-IS link-state protocol data units (PDUs). An attacker could exploit this vulnerability by sending a crafted link-state PDU to an affected system to be processed. A successful exploit could allow the attacker to cause all routers within the IS-IS area to unexpectedly restart the IS-IS process, resulting in a DoS condition.

Recommendations For Cisco IOS XR Software versions prior to Release 6.6.3, update to Release 6.6.3 or later to address this vulnerability. As a temporary workaround, consider restricting access to the IS-IS routing protocol to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-03051

CVE-2019-1910

Affected Products

Cisco Ios Xr

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1910 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03051 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1910 · Security Note