CVE-2019-1737
HIGHCisco IOS XE - Unauthenticated Denial of Service via IP SLA Packet Handling
Title source: llmDescription
A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service (DoS) condition on the affected device. The vulnerability is due to improper socket resources handling in the IP SLA responder application code. An attacker could exploit this vulnerability by sending crafted IP SLA packets to an affected device. An exploit could allow the attacker to cause an interface to become wedged, resulting in an eventual denial of service (DoS) condition on the affected device.
References (2)
Core 2
Core References
Patch, Vendor Advisory vendor-advisory
x_refsource_cisco
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-ipsla-dos
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/107604
Scores
CVSS v3
8.6
EPSS
0.0261
EPSS Percentile
83.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-400
CWE-770
Status
published
Products (50)
cisco/ios
12.2\(58\)ex
cisco/ios
12.2\(58\)ez
cisco/ios
12.2\(60\)ez
cisco/ios
12.2\(60\)ez1
cisco/ios
12.2\(60\)ez2
cisco/ios
12.2\(60\)ez3
cisco/ios
12.2\(60\)ez4
cisco/ios
12.2\(60\)ez5
cisco/ios
12.2\(60\)ez6
cisco/ios
12.2\(60\)ez7
... and 40 more
Published
Mar 27, 2019
Tracked Since
Feb 18, 2026