1. Home
  2. CVE Database
  3. CVE-2019-16023
HIGH · 7.5

CVE-2019-16023

Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a de...

Vulnerability Description

Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to incorrect processing of BGP update messages that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update messages with malformed attributes to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit these vulnerabilities, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
CiscoIos Xr6.6.1
CiscoAsr 9000-
CiscoAsr 9010-
CiscoAsr 9904-
CiscoAsr 9910-
CiscoAsr 9912-
CiscoAsr 9922-
CiscoNcs 540-
CiscoNcs 5500-
CiscoNcs 6000-
CiscoCarrier Routing System-
CiscoIos Xrv 9000-
CiscoNcs 5001-
CiscoNcs 5002-
CiscoNcs 5011-
CiscoNcs 540L-
CiscoNcs 560-
CiscoNcs 1001-
CiscoNcs 1002-
CiscoNcs 1004-

Related Weaknesses (CWE)

CWE-399

References

FAQ

What is CVE-2019-16023?

CVE-2019-16023 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a de...

How severe is CVE-2019-16023?

CVE-2019-16023 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-16023?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xr, Cisco Asr 9000, Cisco Asr 9010, Cisco Asr 9904, Cisco Asr 9910.