CVE-2019-12624

🗓️ 21 Aug 2019 18:05:32Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 74 Views🌐 WEB

Vulnerability in Cisco IOS XE NGWC web interface allows CSRF attac

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability in the web interface for controlling the Cisco IOS XE operating system allows a hacker to perform cross-site fraudulently crafted requests.	2 Sep 201900:00	–	bdu_fstec
Cisco	Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability	21 Aug 201916:00	–	cisco
Tenable Nessus	Cisco IOS XE NGWC Legacy Wireless Device Manager GUI CSRF Vulnerability (cisco-sa-20190821-iosxe-ngwc-csrf)	3 Dec 201900:00	–	nessus
CNVD	Cisco IOS XE New Generation Wireless Controller Cross-Site Request Forgery Vulnerability	23 Aug 201900:00	–	cnvd
Cvelist	CVE-2019-12624 Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability	21 Aug 201918:05	–	cvelist
Exploit DB	Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery	24 Jul 201900:00	–	exploitdb
EUVD	EUVD-2019-4215	7 Oct 202500:30	–	euvd
exploitpack	Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery	24 Jul 201900:00	–	exploitpack
NVD	CVE-2019-12624	21 Aug 201919:15	–	nvd
OSV	CVE-2019-12624	21 Aug 201919:15	–	osv

NVD

Node

AND

cisco ios_xeRange3.0.xe–3.11.xe

cisco 5760_wireless_lan_controllerMatch-

cisco catalyst_3650-12x48uqMatch-

cisco catalyst_3650-12x48urMatch-

cisco catalyst_3650-12x48uzMatch-

cisco catalyst_3650-24pdMatch-

cisco catalyst_3650-24pdmMatch-

cisco catalyst_3650-48fqMatch-

cisco catalyst_3650-48fqmMatch-

cisco catalyst_3650-8x24uqMatch-

cisco catalyst_3850-12x48uMatch-

cisco catalyst_3850-24uMatch-

cisco catalyst_3850-24xsMatch-

cisco catalyst_3850-24xuMatch-

cisco catalyst_3850-48uMatch-

cisco catalyst_3850-48xsMatch-

cisco catalyst_3850-nm-2-40gMatch-

cisco catalyst_3850-nm-8-10gMatch-

cisco catalyst_4500e_supervisor_engine_8-eMatch-

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "3.xE"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-iosxe-ngwc-csrf

Parameter	Position	Path	Description	CWE
username	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
privilege	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
password	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
description	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
type	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
cfnpassword	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
yearlife	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
hourlife	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
monthlife	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352
minlife	request body	/security/cfgSecurityAAAUsersCreate	CSRF payload targeting admin user creation via the vulnerable endpoint in the web interface.	CWE-352

17 Jun 2026 02:14Current

8.8High risk

Vulners AI Score8.8

CVSS 26.8

CVSS 38.8

EPSS0.18706

SSVC

CWE-352

cisco ios xe ngwc vulnerability csrf attack web interface security nvd