Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1708

A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.

Published

2019-05-03T16:29:00.680

Last Modified

2024-11-21T04:37:08.910

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.6 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

6.9

Weaknesses
  • Type: Secondary
    CWE-404
  • Type: Primary
    CWE-401
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco firepower_threat_defense ≤ 6.2.3.12 Yes
Application cisco firepower_threat_defense ≤ 6.3.0.3 Yes
Operating System cisco adaptive_security_appliance_software ≤ 9.8.4 Yes
Operating System cisco adaptive_security_appliance_software ≤ 9.9.2.50 Yes
Operating System cisco adaptive_security_appliance_software ≤ 9.10.1.17 Yes
Hardware cisco asa-5506-x - No
Hardware cisco asa-5525-x - No
Hardware cisco asa-5555-x - No
Hardware cisco asa_5506h-x - No
Hardware cisco asa_5506w-x - No
Hardware cisco asa_5508-x - No
Hardware cisco asa_5516-x - No
Hardware cisco asa_5545-x - No
References