Cisco IOS XR BGP/MPLS/EVPN unusual condition

Summaryinfo

A vulnerability described as problematic has been identified in Cisco IOS XR. Impacted is an unknown function of the component BGP/MPLS/EVPN. Such manipulation leads to unusual condition. This vulnerability is referenced as CVE-2019-1849. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability was found in Cisco IOS XR (Router Operating System) (unknown version) and classified as problematic. Affected by this issue is an unknown code block of the component BGP/MPLS/EVPN. The manipulation with an unknown input leads to a unusual condition vulnerability. Using CWE to declare the problem leads to CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. Impacted is availability. CVE summarizes:

A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices, a crash could lead to system instability and the inability to process or forward traffic through the device, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.

The bug was discovered 05/15/2019. The weakness was published 05/16/2019 as cisco-sa-20190515-iosxr-evpn-d as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2019-1849 since 12/06/2018. Access to the local network is required for this attack. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/21/2023).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-135139. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XR

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion