CVE-2019-12693 Cisco Adaptive Security Appliance Software Secure Copy Denial of Service Vulnerability

Medium 6.8 Published 2 Oct 2019 Updated 21 Nov 2024

An authenticated attacker with high privileges can cause a denial of service on Cisco ASA devices by triggering an integer overflow during SCP file transfers.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12693?

CVE-2019-12693 is a medium-severity vulnerability in Cisco Adaptive Security Appliance, published on 2 Oct 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to the use of an incorrect data type for a length variable. An attacker could exploit this vulnerability by initiating the transfer of a large file to an affected device via SCP. To exploit this vulnerability, the attacker would need to have valid privilege level 15 credentials on the affected device. A successful exploit could allow the attacker to cause the length variable to roll over, which could cause the affected device to crash.

Weakness: CWE-190, CWE-704

Which versions are affected by CVE-2019-12693?

It affects 2 products.

Products include Cisco Adaptive Security Appliance, Cisco Adaptive Security Appliance Software.

How do I fix CVE-2019-12693?

No fix has been published for CVE-2019-12693 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-12693 being exploited?

There is no known exploitation of CVE-2019-12693 in the wild and no public exploit code.

All Cisco Adaptive Security Appliance vulnerabilities

Sources

Also known as GHSA-rc7c-qrr9-4694.