Auth bypass in Cisco 4221_integrated_services_router
CVE-2019-12643
A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper…
Vulnerability class: Broken Authentication
EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Cisco 4221_integrated_services_router
- Cisco 4321_integrated_services_router
- Cisco 4331_integrated_services_router
- Cisco 4351_integrated_services_router
- Cisco 4431_integrated_services_router
- Cisco 4451-x_integrated_services_router
- Cisco Ios Xe Software — versions unspecified
- Cisco Cloud_services_router_1000v
- Cisco Ios_xe — versions 15.5\(3\)s3.16, 16.6.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-12643?
- CVE-2019-12643 is a critical-severity vulnerability in Cisco 4221_integrated_services_router, classified under Improper Authentication. CVSS score: 10.0/10. Published 2019-08-28.
- How severe is CVE-2019-12643?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2019-12643 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.