CVE-2019-1913 in the critical feed json
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
published 2019-08-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10470
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 25.9%
- EPSS 25.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS.
Patch / fix
- Cisco Cisco Small Business 220 Series Smart Plus Switches 1.1.4.4
Timeline
- Published
- First public exploit (EDB-47442)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
25.94% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-47442 Cisco Small Business 220 Series - Multiple Vulnerabilities remote, 2019-09-30
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Cisco Cisco Small Business 220 Series Smart Plus Switches
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Sources
- CVE List CVE-2019-1913
- NVD CVE-2019-1913
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.