CVE-2019-1712: Cisco IOS XR Software Protocol Independent Multicast Denial of Service Vulnerability
A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the PIM process to restart, resulting in a denial of service condition on an affected device. The vulnerability is due to the incorrect processing of crafted AutoRP packets. An attacker could exploit this vulnerability by sending crafted packets to port UDP 496 on a reachable IP address on the device. A successful exploit could allow the attacker to cause the PIM process to restart. Software versions prior to 6.2.3, 6.3.2, 6.4.0, and 6.5.1 are affected.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1712?
CVE-2019-1712 is a vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software that could allow an unauthenticated attacker to cause a denial of service condition on an affected device.
What is the severity of CVE-2019-1712?
The severity of CVE-2019-1712 is high with a CVSS score of 7.5.
Which versions of Cisco IOS XR Software are affected by CVE-2019-1712?
Cisco IOS XR Software versions up to 6.5.1 are affected by CVE-2019-1712.
How can an attacker exploit CVE-2019-1712?
An unauthenticated attacker can exploit CVE-2019-1712 by sending a specially crafted packet to the affected device, causing the PIM process to restart and resulting in a denial of service condition.
Is there a fix available for CVE-2019-1712?
Yes, Cisco has released software updates to address the vulnerability. It is recommended to update to a fixed version of Cisco IOS XR Software.