CVE-2019-1892 Cisco Small Business Series Switches Memory Corruption Vulnerability

High 7.5 Published 6 Jul 2019 Updated 19 Nov 2024

Unauthenticated remote attackers can cause a denial of service on Cisco Small Business switches by sending malformed HTTPS packets to the management interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1892?

CVE-2019-1892 is a high-severity memory corruption vulnerability in Cisco Small Business 300 Series Managed Switches, published on 6 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a memory corruption on an affected device. The vulnerability is due to improper validation of HTTPS packets. An attacker could exploit this vulnerability by sending a malformed HTTPS packet to the management web interface of the affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition.

Weakness: CWE-119

Which versions are affected by CVE-2019-1892?

It affects 57 products.

Products include Cisco Esw2-350g52dc Firmware, Cisco Esw2-550x48dc Firmware, Cisco Sf200-24 Firmware, Cisco Sf200-24p Firmware, Cisco Sf200-48 Firmware, Cisco Sf200-48p Firmware and 51 more.

How do I fix CVE-2019-1892?

No fix has been published for CVE-2019-1892 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-1892 being exploited?

There is no known exploitation of CVE-2019-1892 in the wild and no public exploit code.

Sources

Also known as GHSA-4r8c-mv24-j28q.