CVE-2019-12649 — MEDIUM (6.7)

Vulnerability Description

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected device can be configured to not verify the digital signatures of system image files during the boot process. An attacker could exploit this vulnerability by abusing a specific feature that is part of the device boot process. A successful exploit could allow the attacker to install and boot a malicious software image or execute unsigned binaries on the targeted device.

CVSS Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Cisco	Ios Xe	16.8\(1\)
Cisco	Catalyst 3850-12S-E	-
Cisco	Catalyst 3850-12S-S	-
Cisco	Catalyst 3850-12Xs-E	-
Cisco	Catalyst 3850-12Xs-S	-
Cisco	Catalyst 3850-16Xs-E	-
Cisco	Catalyst 3850-16Xs-S	-
Cisco	Catalyst 3850-24P-E	-
Cisco	Catalyst 3850-24P-L	-
Cisco	Catalyst 3850-24P-S	-
Cisco	Catalyst 3850-24Pw-S	-
Cisco	Catalyst 3850-24S-E	-
Cisco	Catalyst 3850-24S-S	-
Cisco	Catalyst 3850-24T-E	-
Cisco	Catalyst 3850-24T-L	-
Cisco	Catalyst 3850-24T-S	-
Cisco	Catalyst 3850-24U-E	-
Cisco	Catalyst 3850-24U-L	-
Cisco	Catalyst 3850-24U-S	-
Cisco	Catalyst 3850-24Xs-E	-

Related Weaknesses (CWE)

CWE-347

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory

FAQ

What is CVE-2019-12649?

CVE-2019-12649 is a vulnerability with a CVSS score of 6.7 (MEDIUM). A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on a...

How severe is CVE-2019-12649?

CVE-2019-12649 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-12649?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Catalyst 3850-12S-E, Cisco Catalyst 3850-12S-S, Cisco Catalyst 3850-12Xs-E, Cisco Catalyst 3850-12Xs-S.