Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1943

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 4.7, indicating it can be exploited remotely over the network but requires specific conditions to be met though user interaction is required and does not require pre-existing privileges . The vulnerability impacts limited data confidentiality, limited integrity, for affected systems. Impacting 114 products from cisco, from cisco, from cisco and 111 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2019, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2019-07-17T21:15:12.453

Last Modified

2024-11-21T04:37:44.213

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.7 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

4.9

Weaknesses

Type: Secondary
CWE-601
Type: Primary
CWE-601

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	cisco	sg200-50_firmware	-	Yes
Hardware	cisco	sg200-50	-	No
Operating System	cisco	sg200-50p_firmware	-	Yes
Hardware	cisco	sg200-50p	-	No
Operating System	cisco	sg200-50fp_firmware	-	Yes
Hardware	cisco	sg200-50fp	-	No
Operating System	cisco	sg200-26_firmware	-	Yes
Hardware	cisco	sg200-26	-	No
Operating System	cisco	sg200-26p_firmware	-	Yes
Hardware	cisco	sg200-26p	-	No
Operating System	cisco	sg200-26fp_firmware	-	Yes
Hardware	cisco	sg200-26fp	-	No
Operating System	cisco	sg200-18_firmware	-	Yes
Hardware	cisco	sg200-18	-	No
Operating System	cisco	sg200-10fp_firmware	-	Yes
Hardware	cisco	sg200-10fp	-	No
Operating System	cisco	sg200-08_firmware	-	Yes
Hardware	cisco	sg200-08	-	No
Operating System	cisco	sg200-08p_firmware	-	Yes
Hardware	cisco	sg200-08p	-	No
Operating System	cisco	sf200-24_firmware	-	Yes
Hardware	cisco	sf200-24	-	No
Operating System	cisco	sf200-24p_firmware	-	Yes
Hardware	cisco	sf200-24p	-	No
Operating System	cisco	sf200-24fp_firmware	-	Yes
Hardware	cisco	sf200-24fp	-	No
Operating System	cisco	sf200-48_firmware	-	Yes
Hardware	cisco	sf200-48	-	No
Operating System	cisco	sf200-48p_firmware	-	Yes
Hardware	cisco	sf200-48p	-	No
Operating System	cisco	sf302-08pp_firmware	1.3.7.18	Yes
Hardware	cisco	sf302-08pp	-	No
Operating System	cisco	sf302-08mpp_firmware	1.3.7.18	Yes
Hardware	cisco	sf302-08mpp	-	No
Operating System	cisco	sg300-10pp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10pp	-	No
Operating System	cisco	sg300-10mpp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10mpp	-	No
Operating System	cisco	sf300-24pp_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-24pp	-	No
Operating System	cisco	sf300-48pp_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-48pp	-	No
Operating System	cisco	sg300-28pp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-28pp	-	No
Operating System	cisco	sf300-08_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-08	-	No
Operating System	cisco	sf300-48p_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-48p	-	No
Operating System	cisco	sg300-10mp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10mp	-	No
Operating System	cisco	sg300-10p_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10p	-	No
Operating System	cisco	sg300-10_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10	-	No
Operating System	cisco	sg300-28p_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-28p	-	No
Operating System	cisco	sf300-24p_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-24p	-	No
Operating System	cisco	sf302-08mp_firmware	1.3.7.18	Yes
Hardware	cisco	sf302-08mp	-	No
Operating System	cisco	sg300-28_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-28	-	No
Operating System	cisco	sf300-48_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-48	-	No
Operating System	cisco	sg300-20_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-20	-	No
Operating System	cisco	sf302-08p_firmware	1.3.7.18	Yes
Hardware	cisco	sf302-08p	-	No
Operating System	cisco	sg300-52_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-52	-	No
Operating System	cisco	sf300-24_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-24	-	No
Operating System	cisco	sf302-08_firmware	1.3.7.18	Yes
Hardware	cisco	sf302-08	-	No
Operating System	cisco	sf300-24mp_firmware	1.3.7.18	Yes
Hardware	cisco	sf300-24mp	-	No
Operating System	cisco	sg300-10sfp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-10sfp	-	No
Operating System	cisco	sg300-28mp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-28mp	-	No
Operating System	cisco	sg300-52p_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-52p	-	No
Operating System	cisco	sg300-52mp_firmware	1.3.7.18	Yes
Hardware	cisco	sg300-52mp	-	No
Operating System	cisco	sg500-28mpp_firmware	-	Yes
Hardware	cisco	sg500-28mpp	-	No
Operating System	cisco	sg500-52mp_firmware	-	Yes
Hardware	cisco	sg500-52mp	-	No
Operating System	cisco	sg500xg-8f8t_firmware	-	Yes
Hardware	cisco	sg500xg-8f8t	-	No
Operating System	cisco	sf500-24_firmware	-	Yes
Hardware	cisco	sf500-24	-	No
Operating System	cisco	sf500-24p_firmware	-	Yes
Hardware	cisco	sf500-24p	-	No
Operating System	cisco	sf500-48_firmware	-	Yes
Hardware	cisco	sf500-48	-	No
Operating System	cisco	sf500-48p_firmware	-	Yes
Hardware	cisco	sf500-48p	-	No
Operating System	cisco	sg500-28_firmware	-	Yes
Hardware	cisco	sg500-28	-	No
Operating System	cisco	sg500-28p_firmware	-	Yes
Hardware	cisco	sg500-28p	-	No
Operating System	cisco	sg500-52_firmware	-	Yes
Hardware	cisco	sg500-52	-	No
Operating System	cisco	sg500-52p_firmware	-	Yes
Hardware	cisco	sg500-52p	-	No
Operating System	cisco	sg500x-24_firmware	-	Yes
Hardware	cisco	sg500x-24	-	No
Operating System	cisco	sg500x-24p_firmware	-	Yes
Hardware	cisco	sg500x-24p	-	No
Operating System	cisco	sg500x-48_firmware	-	Yes
Hardware	cisco	sg500x-48	-	No
Operating System	cisco	sg500x-48p_firmware	-	Yes
Hardware	cisco	sg500x-48p	-	No

References

http://www.securityfocus.com/bid/109288 Third Party Advisory, VDB Entry ([email protected])
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/109288 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For cisco's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.