CVE-2019-1858 [High] | Input Validation Bypass in Nx-Os

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the SNMP application to leak system memory, which could cause an affected device to restart unexpectedly. The vulnerability is due to improper error handling when processing inbound SNMP packets. An attacker could exploit this vulnerability by sending multiple crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the SNMP application to leak system memory because of an improperly handled error condition during packet processing. Over time, this memory leak could cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	2.43%	2.62%	+0.19%
2	2026-05-01	2.99%	2.43%	-0.57%
3	2025-12-27	—	2.99%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

2.43%

2.62%

+0.19%

2026-05-01

2.99%

2.43%

-0.57%

2025-12-27

—

2.99%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.6	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	4.0	[email protected]
8.6	3.0	HIGH	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	4.0	[email protected]
5.0	2.0	MEDIUM	`AV:N/AC:L/Au:N/C:N/I:N/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:P) Partial availability impact.	10.0	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.6

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

4.0

[email protected]

8.6

3.0

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

4.0

[email protected]

5.0

2.0

MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:P): Partial availability impact.

10.0

2.9

[email protected]

Affected software / configurations for CVE-2019-1858

Vendor	Product	Version	Raw CPE
cisco	nx-os	< 8.1\(1\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	< 7.0\(3\)i4\(8\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 7.0\(3\)i7, < 7.0\(3\)i7\(2\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 7.0\(3\), < 7.0\(3\)f3\(1\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	< 7.1\(5\)n1\(1b\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 7.3, < 7.3\(4\)n1\(1a\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	< 6.2\(22\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 7.2, < 7.2\(0\)d1\(1\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 8.0, < 8.1\(1\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	firepower_extensible_operating_system	>= 2.6, < 2.6.1.131	cpe:2.3:o:cisco:firepower_extensible_operating_system::::::::
cisco	fx-os	< 2.2.2.91	cpe:2.3:o:cisco:fx-os::::::::
cisco	fx-os	>= 2.3, < 2.3.1.130	cpe:2.3:o:cisco:fx-os::::::::
cisco	fx-os	>= 2.4, < 2.4.1.222	cpe:2.3:o:cisco:fx-os::::::::
cisco	nx-os	< 14.0\(2c\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	>= 14.1, < 14.1\(1i\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	< 6.0\(2\)a8\(4\)	cpe:2.3:o:cisco:nx-os::::::::
cisco	nx-os	< 5.2\(1\)sv3\(4.1a\)	cpe:2.3:o:cisco:nx-os::::::::

References for CVE-2019-1858

URL	Tags
http://www.securityfocus.com/bid/108358	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-snmp-dos	Vendor Advisory

URL

CVE-2019-1858 | Cisco FXOS and NX-OS Software Simple Network Management Protocol Denial of Service Vulnerability

Exploit prediction scoring system (EPSS) score for CVE-2019-1858

Common vulnerability scoring system (CVSS) metrics for CVE-2019-1858

Weakness enumeration for CVE-2019-1858

Affected software / configurations for CVE-2019-1858

References for CVE-2019-1858