CVE-2019-1748: Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Valid

Description

A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt and modify confidential information on user connections to the affected software.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco IOS and IOS XE Software

3.7.7Saffected
3.9.1Saffected
3.9.0Saffected
3.9.2Saffected
3.9.1aSaffected
3.9.0aSaffected
3.3.0SEaffected
3.3.1SEaffected
3.3.2SEaffected
3.3.3SEaffected
3.3.4SEaffected
3.3.5SEaffected
3.3.0XOaffected
3.3.1XOaffected
3.3.2XOaffected
3.5.0Eaffected
3.5.1Eaffected
3.5.2Eaffected
3.5.3Eaffected
3.10.0Saffected
3.10.1Saffected
3.10.2Saffected
3.10.3Saffected
3.10.4Saffected
3.10.5Saffected
3.10.6Saffected
3.10.2aSaffected
3.10.2tSaffected
3.10.7Saffected
3.10.8Saffected
3.10.8aSaffected
3.10.9Saffected
3.10.10Saffected
3.11.1Saffected
3.11.2Saffected
3.11.0Saffected
3.11.3Saffected
3.11.4Saffected
3.12.0Saffected
3.12.1Saffected
3.12.2Saffected
3.12.3Saffected
3.12.0aSaffected
3.12.4Saffected
3.13.0Saffected
3.13.1Saffected
3.13.2Saffected
3.13.3Saffected
3.13.4Saffected
3.13.5Saffected
3.13.2aSaffected
3.13.0aSaffected
3.13.5aSaffected
3.13.6Saffected
3.13.7Saffected
3.13.6aSaffected
3.13.6bSaffected
3.13.7aSaffected
3.13.8Saffected
3.13.9Saffected
3.6.0Eaffected
3.6.1Eaffected
3.6.0aEaffected
3.6.0bEaffected
3.6.2aEaffected
3.6.2Eaffected
3.6.3Eaffected
3.6.4Eaffected
3.6.5Eaffected
3.6.6Eaffected
3.6.5aEaffected
3.6.5bEaffected
3.6.7Eaffected
3.6.7aEaffected
3.6.7bEaffected
3.6.9Eaffected
3.6.10Eaffected
3.6.9aEaffected
3.14.0Saffected
3.14.1Saffected
3.14.2Saffected
3.14.3Saffected
3.14.4Saffected
3.15.0Saffected
3.15.1Saffected
3.15.2Saffected
3.15.1cSaffected
3.15.3Saffected
3.15.4Saffected
3.7.0Eaffected
3.7.1Eaffected
3.7.2Eaffected
3.7.3Eaffected
3.7.4Eaffected
3.7.5Eaffected
3.16.0Saffected
3.16.1Saffected
3.16.0aSaffected
3.16.1aSaffected
3.16.2Saffected
3.16.2aSaffected
3.16.0bSaffected
3.16.0cSaffected
3.16.3Saffected
3.16.2bSaffected
3.16.3aSaffected
3.16.4Saffected
3.16.4aSaffected
3.16.4bSaffected
3.16.4gSaffected
3.16.5Saffected
3.16.4cSaffected
3.16.4dSaffected
3.16.4eSaffected
3.16.6Saffected
3.16.5aSaffected
3.16.5bSaffected
3.16.7Saffected
3.16.6bSaffected
3.16.7aSaffected
3.17.0Saffected
3.17.1Saffected
3.17.2Saffected
3.17.1aSaffected
3.17.3Saffected
3.17.4Saffected
16.1.1affected
16.1.2affected
16.1.3affected
16.2.1affected
16.2.2affected
3.8.0Eaffected
3.8.1Eaffected
3.8.2Eaffected
3.8.3Eaffected
3.8.4Eaffected
3.8.5Eaffected
3.8.5aEaffected
3.8.6Eaffected
16.3.1affected
16.3.2affected
16.3.3affected
16.3.1aaffected
16.3.4affected
16.3.5affected
16.3.5baffected
16.4.1affected
16.4.2affected
16.4.3affected
16.5.1affected
16.5.1aaffected
16.5.1baffected
16.5.2affected
3.18.0aSaffected
3.18.0Saffected
3.18.1Saffected
3.18.2Saffected
3.18.3Saffected
3.18.4Saffected
3.18.0SPaffected
3.18.1SPaffected
3.18.1aSPaffected
3.18.1gSPaffected
3.18.1bSPaffected
3.18.1cSPaffected
3.18.2SPaffected
3.18.1hSPaffected
3.18.2aSPaffected
3.18.1iSPaffected
3.18.3SPaffected
3.18.4SPaffected
3.18.3aSPaffected
3.18.3bSPaffected
3.18.5SPaffected
3.9.0Eaffected
3.9.1Eaffected
3.9.2Eaffected
3.9.2bEaffected
16.6.1affected
16.6.2affected
3.10.0Eaffected
3.10.0cEaffected

CVE-2019-1748

Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation Vulnerability

Description

Affected products

Cisco Cisco IOS and IOS XE Software

References