CVE-2019-1761

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficient memory initialization. An attacker could exploit this vulnerability by receiving HSRPv2 traffic from an adjacent HSRP member. A successful exploit could allow the attacker to receive potentially sensitive information from the adjacent device.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-665

Affected software

Vendor	Product	Versions
Cisco	Cisco IOS and IOS XE Software	3.2.0SG; 3.2.1SG; 3.2.2SG; 3.2.3SG; 3.2.4SG; 3.2.5SG; 3.2.6SG; 3.2.7SG; 3.2.8SG; 3.2.9SG; 3.2.10SG; 3.2.11SG; 3.7.0S; 3.7.1S; 3.7.2S; 3.7.3S; 3.7.4S; 3.7.5S; 3.7.6S; 3.7.7S

References

http://www.securityfocus.com/bid/107620Broken Link, Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-ios-infoleakPatch, Vendor Advisory
http://www.securityfocus.com/bid/107620Broken Link, Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-ios-infoleakPatch, Vendor Advisory

Timeline

Published: Mar 28, 2019
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-176106.1HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.CVE-2019-176116.1HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.CVE-2019-176127.2An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.c CVE-2019-176139.8qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature t CVE-2019-17624.4A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensit CVE-2019-176219.8The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec CVE-2019-176247.8"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 tim CVE-2019-176259.0There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The prob CVE-2019-176269.8ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document CVE-2019-176276.5The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic duri CVE-2019-176294.8CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.CVE-2019-17637.5A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could all