CVE-2019-1981CWE-20

CVE-2019-1981

Medium · published November 6, 2019

CVSS v3.1
5.8
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to insufficient normalization of a text-based payload. An attacker could exploit this vulnerability by sending traffic that contains specifically obfuscated payloads through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious payloads to protected systems that would otherwise be blocked.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01042 · 63.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2019-11-06T01:15Z
Affected products (7)
ProductVersionsFixed in
cisco/firepower_services_software_for_asaall versions—
cisco/secure_firewall_management_center≥ 2.9.12, ≤ 2.9.12.15—
cisco/secure_firewall_management_center≥ 2.9.13, ≤ 2.9.13.6—
cisco/secure_firewall_management_center≥ 2.9.14.0, ≤ 2.9.14.5—
cisco/secure_firewall_management_centerall versions—
cisco/secure_firewall_management_centerall versions—
cisco/secure_firewall_threat_defenseall versions—
References (2)
EPSS history
Timeline
  • 05 NOV 19:35Z
    Cisco Firepower Threat Defense Software NULL Character Obfuscation Detection Bypass Vulnerability
    cvelistv5