Skip to content
Fencer Vulns
medium 6.8

CVE-2019-1814 json

Cisco Small Business 300 Series Managed Switches DHCP Denial of Service Vulnerability

published 2019-05-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10371

cvss
6.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device.

Patch / fix

  • cisco sf302-08pp_firmware 1.4.10.6
  • cisco sf302-08mpp_firmware 1.4.10.6
  • cisco sg300-10pp_firmware 1.4.10.6
  • cisco sg300-10mpp_firmware 1.4.10.6
  • cisco sf300-24pp_firmware 1.4.10.6
  • cisco sf300-48pp_firmware 1.4.10.6
  • cisco sg300-28pp_firmware 1.4.10.6
  • cisco sf300-08_firmware 1.4.10.6
  • cisco sf300-48p_firmware 1.4.10.6
  • cisco sg300-10mp_firmware 1.4.10.6
  • cisco sg300-10p_firmware 1.4.10.6
  • cisco sg300-10_firmware 1.4.10.6
  • cisco sg300-28p_firmware 1.4.10.6
  • cisco sf300-24p_firmware 1.4.10.6
  • cisco sf302-08mp_firmware 1.4.10.6
  • cisco sg300-28_firmware 1.4.10.6
  • cisco sf300-48_firmware 1.4.10.6
  • cisco sg300-20_firmware 1.4.10.6
  • cisco sf302-08p_firmware 1.4.10.6
  • cisco sg300-52_firmware 1.4.10.6

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Cisco Cisco Small Business 300 Series Managed Switches

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.