CVE-2019-12665: Cisco IOS and IOS XE Software HTTP Client Information Disclosure Vulnerability

Published Sep 25, 2019

Updated

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel. The vulnerability is due to TCP port information not being considered when matching new requests to existing, persistent HTTP connections. An attacker could exploit this vulnerability by acting as a man-in-the-middle and then reading and/or modifying data that should normally have been sent through an encrypted channel.

Affected Software

2 affected components

Cisco IOS=15.6\(2\)t

Cisco IOS=fd-1.5.0

Event History

Sep 25, 2019

CVE Published

via MITRE·08:15 PM

Data Sourced

via MITRE·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-12665?

CVE-2019-12665 has been assigned a high severity rating due to its potential impact on data confidentiality.

How do I fix CVE-2019-12665?

To fix CVE-2019-12665, upgrade to the latest version of Cisco IOS or IOS XE that addresses this vulnerability.

What systems are affected by CVE-2019-12665?

CVE-2019-12665 affects specific versions of Cisco IOS and IOS XE Software, including 15.6(2)t and fd-1.5.0.

What kind of attack does CVE-2019-12665 enable?

CVE-2019-12665 allows an unauthenticated remote attacker to read and modify data that should be transmitted over an encrypted channel.

Is there a workaround for CVE-2019-12665?

There are no recommended workarounds for CVE-2019-12665; the best course of action is to apply the necessary software updates.