Multiple Cisco Products CVE-2019-1649 Tampering Security Bypass Vulnerability

Bugtraq ID:	108350
Class:	Input Validation Error
CVE:	CVE-2019-1649
Remote:	No
Local:	Yes
Published:	May 13 2019 12:00AM
Updated:	May 13 2019 12:00AM
Credit:	atin Kataria (Principal Research Scientist), Richard Housley (Research Scientist), and Dr. Ang Cui (Chief Scientist) of Red Balloon Security
Vulnerable:	Cisco Trust Anchor module 0 Cisco Packet-over-T3/E3 Service Module 0 Cisco Nexus 9500 0 Cisco Nexus 9300 0 Cisco Nexus 9200 0 Cisco Nexus 9000 0 Cisco Nexus 7000 0 Cisco Nexus 3264C-E Switches 0 Cisco Nexus 3132C-Z Switches 0 Cisco Nexus 31108TC-V 0 Cisco Nexus 31108PC-V 0 Cisco Network Convergence System 5500 Series Routers 0 Cisco Network Convergence System 5002 0 Cisco Network Convergence System 5001 0 Cisco Network Convergence System 1002 0 Cisco NCS 200 Series 0 Cisco MDS 9000 Cisco IC3000 Industrial Compute Gateway 0 Cisco Firepower 9000 Series 0 Cisco Firepower 4000 Series 0 Cisco Firepower 2100 Series 0 Cisco Connected Grid Routers 0 Cisco cBR-8 Converged Broadband Router 0 Cisco Catalyst 9800-80 Wireless Controller 0 Cisco Catalyst 9800-40 Wireless Controller 0 Cisco Catalyst 9600 0 Cisco Catalyst 9500 Series Switch 0 Cisco Catalyst 9300 Series Switches 0 Cisco Catalyst 6800 0 Cisco ASR 920 Series Aggregation Services Router 0 Cisco ASR 9000 Series Aggregation Services Routers 0 Cisco ASR 900 Route Switch Processor 3 (RSP3) 0 Cisco ASR 900 Route Switch Processor 2 (RSP2) 0 Cisco ASR 1000 Series Routers 0 Cisco ASA 5500-X Series with FirePOWER Services 0 Cisco ASA 5500-X Series with FirePOWER Service 5.3 Cisco Analog Voice Network Interface Module 0 Cisco 829 Industrial Integrated Services Routers 0 Cisco 809 Industrial Integrated Services Routers 0 Cisco 5000 Series Enterprise Network Compute System 0 Cisco 4461 Integrated Services Router 0 Cisco 4451-X Integrated Services Router 0 Cisco 4431 Integrated Services Router 0 Cisco 4351 Integrated Services Router 0 Cisco 4331 Integrated Services Router 0 Cisco 4321 Integrated Services Router 0 Cisco 4221 Integrated Services Router 0 Cisco 4000 Series Integrated Services Routers 0 Cisco 4000 Cisco 3000 Series Industrial Security Appliances (ISAs) 0
Not Vulnerable:

Multiple Cisco Products CVE-2019-1649 Tampering Security Bypass Vulnerability

Multiple Cisco Products are prone to a security-bypass vulnerability.

A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

This issue is being tracked by Cisco Bug IDsCSCvn77141, CSCvn77142,CSCvn77143,CSCvn77147, CSCvn77150, CSCvn77151, CSCvn77152, CSCvn77153, CSCvn77154, CSCvn77155,CSCvn77156, CSCvn77158, CSCvn77159, CSCvn77160, CSCvn77162, CSCvn77166, CSCvn77167, CSCvn77168, CSCvn77169, CSCvn77170, CSCvn77171, CSCvn77172, CSCvn77175, CSCvn77180, CSCvn77181, CSCvn77182, CSCvn77183, CSCvn77184, CSCvn77185, CSCvn77191, CSCvn77201, CSCvn77202, CSCvn77205, CSCvn77207, CSCvn77209, CSCvn77212, CSCvn77219, CSCvn77220, CSCvn77245, CSCvn77246, CSCvn77248, CSCvn77249, CSCvn89137, CSCvn89138, CSCvn89140, CSCvn89143, CSCvn89144, CSCvn89145, CSCvn89146,CSCvn89150, and CSCvp42792.

Multiple Cisco Products CVE-2019-1649 Tampering Security Bypass Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Secure Boot Hardware Tampering Vulnerability (Cisco)
  
• Cisco Trust Anchor module (TAm) improperly checks code and Cisco IOS XE web UI d (Cisco)