CVE-2019-1751: Cisco IOS Software NAT64 Denial of Service Vulnerability

Published Mar 28, 2019

Updated

A vulnerability in the Network Address Translation 64 (NAT64) functions of Cisco IOS Software could allow an unauthenticated, remote attacker to cause either an interface queue wedge or a device reload. The vulnerability is due to the incorrect handling of certain IPv4 packet streams that are sent through the device. An attacker could exploit this vulnerability by sending specific IPv4 packet streams through the device. An exploit could allow the attacker to either cause an interface queue wedge or a device reload, resulting in a denial of service (DoS) condition.

Affected Software

80 affected components

Cisco IOS=15.4\(1\)cg1

Cisco IOS=15.4\(1\)t

Cisco IOS=15.4\(1\)t1

Cisco IOS=15.4\(1\)t2

Cisco IOS=15.4\(1\)t3

Cisco IOS=15.4\(1\)t4

Cisco IOS=15.4\(2\)t

Cisco IOS=15.4\(2\)t1

Cisco IOS=15.4\(2\)t2

Cisco IOS=15.4\(2\)t3

Cisco IOS=15.4\(2\)t4

Cisco IOS=15.4\(3\)m

Cisco IOS=15.4\(3\)m1

Cisco IOS=15.4\(3\)m2

Cisco IOS=15.4\(3\)m3

Cisco IOS=15.4\(3\)m4

Cisco IOS=15.4\(3\)m5

Cisco IOS=15.4\(3\)m6

Cisco IOS=15.4\(3\)m6a

Cisco IOS=15.4\(3\)m7

Cisco IOS=15.4\(3\)m7a

Cisco IOS=15.4\(3\)m8

Cisco IOS=15.4\(3\)m9

Cisco IOS=15.4\(3\)m10

Cisco IOS=15.5\(1\)t

Cisco IOS=15.5\(1\)t1

Cisco IOS=15.5\(1\)t2

Cisco IOS=15.5\(1\)t3

Cisco IOS=15.5\(1\)t4

Cisco IOS=15.5\(2\)t

Cisco IOS=15.5\(2\)t1

Cisco IOS=15.5\(2\)t2

Cisco IOS=15.5\(2\)t3

Cisco IOS=15.5\(2\)t4

Cisco IOS=15.5\(2\)xb

Cisco IOS=15.5\(3\)m

Cisco IOS=15.5\(3\)m0a

Cisco IOS=15.5\(3\)m1

Cisco IOS=15.5\(3\)m2

Cisco IOS=15.5\(3\)m2a

Cisco IOS=15.5\(3\)m3

Cisco IOS=15.5\(3\)m4

Cisco IOS=15.5\(3\)m4a

Cisco IOS=15.5\(3\)m4b

Cisco IOS=15.5\(3\)m4c

Cisco IOS=15.5\(3\)m5

Cisco IOS=15.5\(3\)m5a

Cisco IOS=15.5\(3\)m6

Cisco IOS=15.5\(3\)m6a

Cisco IOS=15.5\(3\)m7

Cisco IOS=15.5\(3\)m8

Cisco IOS=15.6\(1\)t

Cisco IOS=15.6\(1\)t0a

Cisco IOS=15.6\(1\)t1

Cisco IOS=15.6\(1\)t2

Cisco IOS=15.6\(1\)t3

Cisco IOS=15.6\(2\)t

Cisco IOS=15.6\(2\)t0a

Cisco IOS=15.6\(2\)t1

Cisco IOS=15.6\(2\)t2

Cisco IOS=15.6\(2\)t3

Cisco IOS=15.6\(3\)m

Cisco IOS=15.6\(3\)m0a

Cisco IOS=15.6\(3\)m1

Cisco IOS=15.6\(3\)m1a

Cisco IOS=15.6\(3\)m1b

Cisco IOS=15.6\(3\)m2

Cisco IOS=15.6\(3\)m2a

Cisco IOS=15.6\(3\)m3

Cisco IOS=15.6\(3\)m3a

Cisco IOS=15.6\(3\)m4

Cisco IOS=15.6\(3\)m5

Cisco IOS=15.7\(3\)m

Cisco IOS=15.7\(3\)m0a

Cisco IOS=15.7\(3\)m1

Cisco IOS=15.7\(3\)m2

Cisco IOS=15.7\(3\)m3

Cisco IOS=15.8\(3\)m

Cisco IOS=15.8\(3\)m0a

Cisco IOS=15.8\(3\)m0b

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nat64

Event History

Mar 28, 2019

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:29 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-1751?

CVE-2019-1751 has a high severity rating due to its potential to allow unauthorized remote access and device instability.

How do I fix CVE-2019-1751?

To fix CVE-2019-1751, update the Cisco IOS Software to a version that is not affected by this vulnerability.

What are the affected Cisco IOS versions for CVE-2019-1751?

CVE-2019-1751 affects various versions of Cisco IOS, including 15.4(1)cg1, 15.4(1)t, and multiple 15.4 and 15.5 series versions.

Is CVE-2019-1751 exploitable without authentication?

Yes, CVE-2019-1751 is exploitable by an unauthenticated remote attacker.

What type of impact can CVE-2019-1751 have on my network?

CVE-2019-1751 can lead to a device reload or create a condition that wedges the interface queue, disrupting network services.