Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

published 2019-06-21 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10461

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software with the HTTP Server feature enabled. The default state of the HTTP Server feature is version dependent.

Patch / fix

fixed in 1

Cisco Cisco IOS XE Software 16.4.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 mo ago (2024-11-20)

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Cisco Cisco IOS XE Software

Classification

Weakness

CWE-352 Cross-Site Request Forgery

Technology feeds

Cisco IOS rss critical rss

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20190612-iosxe-csrf
vendor-advisory

Sources

CVE List CVE-2019-1904
NVD CVE-2019-1904

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary