CVE-2019-15998

A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-iosxr-ssh-bypass	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:ios_xr:6.5.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*

OR	cpe:2.3:h:cisco:asr_9001:-:::::::*
	cpe:2.3:h:cisco:asr_9006:-:::::::*
	cpe:2.3:h:cisco:asr_9010:-:::::::*
	cpe:2.3:h:cisco:asr_9901:-:::::::*
	cpe:2.3:h:cisco:asr_9904:-:::::::*
	cpe:2.3:h:cisco:asr_9912:-:::::::*
	cpe:2.3:h:cisco:asr_9922:-:::::::*

History

No history.

Information

Published : 2019-11-26 04:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-15998

Mitre link : CVE-2019-15998

CVE.ORG link : CVE-2019-15998

JSON object : View

Products Affected

cisco

asr_9001
ios_xr
asr_9922
asr_9006
asr_9904
asr_9912
asr_9010
asr_9901

CWE

CWE-862

Missing Authorization

CWE-284

Improper Access Control

{"id": "CVE-2019-15998", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-11-26T04:15:12.547", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-iosxr-ssh-bypass", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device."}, {"lang": "es", "value": "Una vulnerabilidad en la l\u00f3gica de control de acceso de NETCONF sobre Secure Shell (SSH) del Software Cisco IOS XR, puede permitir conexiones a pesar de una lista de control de acceso (ACL) configurada para denegar el acceso a NETCONF sobre SSH de un dispositivo afectado. La vulnerabilidad es debido a una falta de comprobaci\u00f3n en la lista de control de acceso (ACL) de NETCONF sobre SSH. Un atacante podr\u00eda explotar esta vulnerabilidad al conectarse en un dispositivo afectado usando NETCONF sobre SSH. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conectar con el dispositivo en el puerto NETCONF. Unas credenciales v\u00e1lidas son requeridas para acceder al dispositivo. Esta vulnerabilidad no afecta las conexiones al proceso SSH predeterminado en el dispositivo."}], "lastModified": "2020-10-16T13:32:44.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2FD2C84-CD64-4C1C-BC38-2F7A2A6EEF45"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DE98B34-501B-449A-843A-58F297EDBE1B"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86E05C3F-4095-4B9C-8C11-E32567EB14AC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039"}, {"criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16"}, {"criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29"}, {"criteria": "cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2D5E60AB-94FF-448A-89D8-5D2197E21C74"}, {"criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3"}, {"criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181"}, {"criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}