Auth bypass in Cisco Asr 9001
CVE-2019-15998
A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device.
EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Cisco Asr_9001
- Cisco Asr_9006
- Cisco Asr_9010
- Cisco Asr_9901
- Cisco Asr_9904
- Cisco Asr_9912
- Cisco Asr_9922
- Cisco Ios Xr Software — versions unspecified
- Cisco Ios_xr — versions 6.5.1, 6.5.2, 6.5.3
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15998?
- CVE-2019-15998 is a medium-severity vulnerability in Cisco Asr 9001, classified under Improper Access Control. CVSS score: 5.3/10. Published 2019-11-26.
- How severe is CVE-2019-15998?
- Medium severity. CVSS v3 base score is 5.3 out of 10.