CVE-2019-12643 describes a critical authentication bypass vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software, affecting various Cisco Integrated Services Routers and the Cloud Services Router 1000V. This flaw, due to an improper check in the REST API authentication service, allows an unauthenticated, remote attacker to obtain an authenticated user's token-id by submitting malicious HTTP requests. With a CVSS score of 10.0, the vulnerability carries a critical risk, enabling attackers to bypass authentication and execute privileged actions through the REST API interface, though this interface is not enabled by default. While not listed in CISA's KEV catalog, there is public proof-of-concept code and community discussion, indicating a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
15.5\(3\)s3.16CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:15.5\(3\)s3.16:*:*:*:*:*:*:* | ||
16.6.5CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.