CVE-2019-1710

CRITICAL

A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device.

Published: Apr 17, 2019 Modified: Jun 17, 2026

CWE-20 CWE-20

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (2)

Vendor	Product	Version
cisco	ios_xr	* < 6.5.3
cisco	ios_xr	* ≥ 7.0 < 7.0.1

GitHub Security Advisory GHSA-hj3w-wg7f-x694

A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation...

References (4)

http://www.securityfocus.com/bid/108007 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr Vendor Advisory
http://www.securityfocus.com/bid/108007 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.83%

Top 14% most likely to be exploited

Threat Score 40 / 100

Data Sources

NVD EPSS GitHub