CVE-2019-12649 (CNNVD-201909-1126)
中文标题:
Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞
英文标题:
Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability
漏洞描述
中文描述:
Cisco Catalyst 3850 Series Switches和Cisco Catalyst 9300 Series Switches都是美国思科（Cisco）公司的产品。Cisco Catalyst 3850 Series Switches是一款3850系列交换机。Cisco Catalyst 9300 Series Switches是一款9300系列交换机。IOS XE是一套为其网络设备开发的操作系统。 Cisco Catalyst 3850 Series Switches和9300 Series Switches中的IOS XE的镜像验证功能存在数据伪造问题漏洞，该漏洞源于在特定环境中，受影响的设备会进行配置，不去验证系统镜像的数字签名。本地攻击者可利用该漏洞安装并启动恶意的软件镜像或执行未签名的二进制文件。
英文描述:
A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected device can be configured to not verify the digital signatures of system image files during the boot process. An attacker could exploit this vulnerability by abusing a specific feature that is part of the device boot process. A successful exploit could allow the attacker to install and boot a malicious software image or execute unsigned binaries on the targeted device.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco IOS XE Software 3.2.11aSG | - | < n/a | - |
cpe:2.3:a:cisco:cisco_ios_xe_software_3.2.11asg:*:*:*:*:*:*:*:*
|
| cisco | ios_xe | 16.8\(1\) | - | - |
cpe:2.3:o:cisco:ios_xe:16.8\(1\):*:*:*:*:*:*:*
|
| cisco | ios | 16.9.1 | - | - |
cpe:2.3:o:cisco:ios:16.9.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.0 (cna)
MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-12649 |
2025-11-11 15:20:00 | 2025-11-11 07:35:30 |
| NVD | nvd_CVE-2019-12649 |
2025-11-11 14:56:26 | 2025-11-11 07:44:03 |
| CNNVD | cnnvd_CNNVD-201909-1126 |
2025-11-11 15:10:17 | 2025-11-11 07:54:52 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201909-1126
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 3
- data_sources: ['cve'] -> ['cve', 'nvd']