Lucene search

CiscoCVE-2019-1920

HistoryJul 17, 2019 - 9:15 p.m.

CVE-2019-1920

2019-07-1721:15:12

CWE-20

cisco

web.nvd.nist.gov

cve-2019-1920

802.11r

fast transition

cisco

ios

access points

vulnerability

dos

nvd

CVSS2

6.1

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.4

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

0.001

Percentile

25.0%

JSON

A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling condition for client authentication requests sent to a targeted interface configured for FT. An attacker could exploit this vulnerability by sending crafted authentication request traffic to the targeted interface, causing the device to restart unexpectedly.

Affected configurations

Nvd

Vulners

Node

ciscoaironet_3700e_firmwareMatch15.3\(3\)jc14

ciscoaironet_3700e_firmwareMatch15.3\(3\)jd6

AND

ciscoaironet_3700eMatch-

Node

ciscoaironet_3700i_firmwareMatch15.3\(3\)jc14

ciscoaironet_3700i_firmwareMatch15.3\(3\)jd6

AND

ciscoaironet_3700iMatch-

Node

ciscoaironet_3700p_firmwareMatch15.3\(3\)jc14

ciscoaironet_3700p_firmwareMatch15.3\(3\)jd6

AND

ciscoaironet_3700pMatch-

Node

ciscoaccess_pointsRange<8.2.170.0

ciscoaccess_pointsRange8.3–8.3.150.0

ciscoaccess_pointsRange8.4–8.5.131.0

ciscoaccess_pointsRange8.6–8.8.100.0

VendorProductVersionCPE
ciscoaironet_3700e_firmware15.3(3)jc14cpe:2.3:o:cisco:aironet_3700e_firmware:15.3\(3\)jc14:*:*:*:*:*:*:*
ciscoaironet_3700e_firmware15.3(3)jd6cpe:2.3:o:cisco:aironet_3700e_firmware:15.3\(3\)jd6:*:*:*:*:*:*:*
ciscoaironet_3700e-cpe:2.3:h:cisco:aironet_3700e:-:*:*:*:*:*:*:*
ciscoaironet_3700i_firmware15.3(3)jc14cpe:2.3:o:cisco:aironet_3700i_firmware:15.3\(3\)jc14:*:*:*:*:*:*:*
ciscoaironet_3700i_firmware15.3(3)jd6cpe:2.3:o:cisco:aironet_3700i_firmware:15.3\(3\)jd6:*:*:*:*:*:*:*
ciscoaironet_3700i-cpe:2.3:h:cisco:aironet_3700i:-:*:*:*:*:*:*:*
ciscoaironet_3700p_firmware15.3(3)jc14cpe:2.3:o:cisco:aironet_3700p_firmware:15.3\(3\)jc14:*:*:*:*:*:*:*
ciscoaironet_3700p_firmware15.3(3)jd6cpe:2.3:o:cisco:aironet_3700p_firmware:15.3\(3\)jd6:*:*:*:*:*:*:*
ciscoaironet_3700p-cpe:2.3:h:cisco:aironet_3700p:-:*:*:*:*:*:*:*
ciscoaccess_points*cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	aironet_3700e_firmware	15.3(3)jc14	cpe:2.3:o:cisco:aironet_3700e_firmware:15.3\(3\)jc14:::::::*
cisco	aironet_3700e_firmware	15.3(3)jd6	cpe:2.3:o:cisco:aironet_3700e_firmware:15.3\(3\)jd6:::::::*
cisco	aironet_3700e	-	cpe:2.3:h:cisco:aironet_3700e:-:::::::*
cisco	aironet_3700i_firmware	15.3(3)jc14	cpe:2.3:o:cisco:aironet_3700i_firmware:15.3\(3\)jc14:::::::*
cisco	aironet_3700i_firmware	15.3(3)jd6	cpe:2.3:o:cisco:aironet_3700i_firmware:15.3\(3\)jd6:::::::*
cisco	aironet_3700i	-	cpe:2.3:h:cisco:aironet_3700i:-:::::::*
cisco	aironet_3700p_firmware	15.3(3)jc14	cpe:2.3:o:cisco:aironet_3700p_firmware:15.3\(3\)jc14:::::::*
cisco	aironet_3700p_firmware	15.3(3)jd6	cpe:2.3:o:cisco:aironet_3700p_firmware:15.3\(3\)jd6:::::::*
cisco	aironet_3700p	-	cpe:2.3:h:cisco:aironet_3700p:-:::::::*
cisco	access_points	*	cpe:2.3:o:cisco:access_points::::::::

CNA Affected

[
  {
    "product": "Cisco Aironet Access Point Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "8.8.100.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/109312

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-aironet-dos

CVSS2

6.1

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.4

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

0.001

Percentile

25.0%

JSON

Related for CVE-2019-1920