CVE-2019-1981

Medium

Description

A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to insufficient normalization of a text-based payload. An attacker could exploit this vulnerability by sending traffic that contains specifically obfuscated payloads through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious payloads to protected systems that would otherwise be blocked.

SeverityMedium
CVSS5.8
Exploit probability—
ProductCisco Firepower Services Software For Asa
PublishedNov 5, 2019
First seenNov 5, 2019
Weakness typeCWE-264CWE-264

How to fix

Affected products

ProductAffected versionsFixed in
cisco firepower_services_software_for_asaNo range specified—
cisco secure_firewall_management_center2.9.12 ≤ v ≤ 2.9.12.15, 2.9.13 ≤ v ≤ 2.9.13.6, 2.9.14.0 ≤ v ≤ 2.9.14.5, 2.9.15, 2.9.16—
cisco secure_firewall_threat_defenseNo range specified—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.

CVE-2019-1981 · Cisco Firepower Services Software For Asa · Dark Radar