CVE-2019-1711 - Cisco IOS XR gRPC Software Denial of Service Vulnerability

Back Back to CVE browser

HIGH

Cisco IOS XR gRPC Software Denial of Service Vulnerability

Published Apr 17, 2019

7.5

HIGH

CVSS 3.0

EPSS 2.30%

Description

A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could cause the emsd process to crash, resulting in a DoS condition. Resolved in Cisco IOS XR 6.5.1 and later.

Affected products

Vendor Cisco Product Cisco IOS XR Software Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.5.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco IOS XR Software

n/a

Version	Status	Constraints
unspecified	affected	<6.5.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

http://www.securityfocus.com/bid/108017
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10268
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ios-xr-dos
vendor-advisoryx_refsource_CISCOVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/108017		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10268		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ios-xr-dos		vendor-advisoryx_refsource_CISCOVendor Advisory