CVE-2019-12659: Cisco IOS XE Software HTTP Server Denial of Service Vulnerability
A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the HTTP server to crash. The vulnerability is due to a logical error in the logging mechanism. An attacker could exploit this vulnerability by generating a high amount of long-lived connections to the HTTP service on the device. A successful exploit could allow the attacker to cause the HTTP server to crash.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-12659?
CVE-2019-12659 is a vulnerability in the HTTP server code of Cisco IOS XE Software that could allow an unauthenticated remote attacker to crash the HTTP server.
How does CVE-2019-12659 affect Cisco IOS XE Software?
CVE-2019-12659 affects Cisco IOS XE Software versions 16.10.1.
What is the severity of CVE-2019-12659?
CVE-2019-12659 has a severity rating of 7.5 (high).
How can an attacker exploit CVE-2019-12659?
An attacker can exploit CVE-2019-12659 by generating a high amount of long HTTP requests.
Is there a fix for CVE-2019-12659?
Yes, Cisco has released a security advisory with steps to mitigate the vulnerability. Please refer to the following link for more information: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-httpserv-dos