What is CVE-2019-1806?

CVE-2019-1806 is a high-severity vulnerability in Cisco 550x Series Stackable Managed Switches, classified under Improper Input Validation. CVSS score: 7.7/10. Published 2019-05-15.

How severe is CVE-2019-1806?

High severity. CVSS v3 base score is 7.7 out of 10.

Resource exhaustion in Cisco 550x Series Stackable Managed Switches

CVE-2019-1806

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switches and Small Business Sx250, Sx350, Sx550 Series Switches could allow an authenticated, remote attacker to cause the SNMP application of an affected device to cease processing traffic, resulting in the CPU utilization reaching one hundred percent. Manual intervention may be required before a device resumes normal operations. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a malicious SNMP packet to an affected device. A successful exploit could allow the attacker to cause the device to cease forwarding traffic, which could result in a denial of service (DoS) condition. Cisco has released firmware updates that address this vulnerability.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2019-05-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.020 (80.4th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 80.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.021 · newest: 0.020 · change: -0.000

Affected products

Cisco 550x Series Stackable Managed Switches — versions unspecified, unspecified
Cisco Esw2-350g52dc
Cisco Esw2-350g52dc Firmware
Cisco Esw2-550x48dc
Cisco Esw2-550x48dc Firmware
Cisco Sf200-24
Cisco Sf200-24 Firmware
Cisco Sf200-24p
Cisco Sf200-24p Firmware
Cisco Sf200-48

Weakness classification (CWE)

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515… (vendor-advisory, Vendor Advisory)
www.securityfocus.com/bid/108335 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2019-1806?: CVE-2019-1806 is a high-severity vulnerability in Cisco 550x Series Stackable Managed Switches, classified under Improper Input Validation. CVSS score: 7.7/10. Published 2019-05-15.
How severe is CVE-2019-1806?: High severity. CVSS v3 base score is 7.7 out of 10.