CVE-2019-1842 Cisco IOS XR Software Secure Shell Authentication Vulnerability
An authenticated remote attacker can bypass command authorization or enumerate users via a logic error in SSH authentication on Cisco IOS XR devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1842?
CVE-2019-1842 is a medium-severity authentication bypass vulnerability in Cisco IOS XR Software, published on 5 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when certain sequences of actions are processed during an SSH login event on the affected device. An attacker could exploit this vulnerability by initiating an SSH session to the device with a specific sequence that presents the two usernames. A successful exploit could result in logging data misrepresentation, user enumeration, or, in certain circumstances, a command authorization bypass. See the Details section for more information.
Which versions are affected by CVE-2019-1842?
It affects 1 product.
Products include Cisco Ios Xr Firmware.
How do I fix CVE-2019-1842?
No fix has been published for CVE-2019-1842 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-1842 being exploited?
There is no known exploitation of CVE-2019-1842 in the wild and no public exploit code.
Sources
Also known as GHSA-v5xq-942q-fwvr.