Vulnerability in Cisco iOS 12.2(15)b
CVE-2019-12665
A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel. The vulnerability is due to TCP port information not being considered when matching new requests to existing, persistent HTTP connections. An attacker could exploit this vulnerability by acting as a man-in-the-middle and then reading and/or modifying data that should normally have been sent through an encrypted channel.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.011 (64.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Cisco iOS 12.2(15)b — versions unspecified
- Cisco iOS — versions 15.6(2)t, fd-1.5.0, 15.6\(2\)t
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-12665?
- CVE-2019-12665 is a high-severity vulnerability in Cisco iOS 12.2(15)b, classified under CWE-399. CVSS score: 7.4/10. Published 2019-09-25.
- How severe is CVE-2019-12665?
- High severity. CVSS v3 base score is 7.4 out of 10.