1. CVE-Search
  2. CVE-2019-1849
ID CVE-2019-1849
Summary A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices, a crash could lead to system instability and the inability to process or forward traffic through the device, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.
References
Vulnerable Configurations
  • cpe:2.3:o:cisco:ios_xr:6.1.0:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.1.0:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.1.1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.1.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.1.2:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.1.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.1.3:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.1.4:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.1.4:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.2.1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.2.2:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.2.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.2.3:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.2.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.2.25:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.2.25:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.3.1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.3.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.3.2:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.3.2:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.4.1_base:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.4.1_base:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios_xr:6.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios_xr:6.6.0:*:*:*:*:*:*:*
CVSS
Base: 6.1 (as of 09-10-2019 - 23:48)
Impact:
Exploitability:
CWE CWE-754
CAPEC
Access
VectorComplexityAuthentication
ADJACENT_NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:A/AC:L/Au:N/C:N/I:N/A:C
refmap via4
bid 108342
cisco 20190515 Cisco IOS XR Software BGP MPLS-Based EVPN Denial of Service Vulnerability
Last major update 09-10-2019 - 23:48
Published 16-05-2019 - 02:29
Last modified 09-10-2019 - 23:48
Back to Top