Skip to content
Fencer Intel
critical 9.8

CVE-2019-1913 in the critical feed json

Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities

published 7y ago modified 4mo ago also EUVD-2019-10470

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
25.9%
EPSS 25.9% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS.

Patch / fix

  • Cisco Cisco Small Business 220 Series Smart Plus Switches 1.1.4.4

Is CVE-2019-1913 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. Published
  2. First public exploit (EDB-47442)

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

25.94% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-47442 Cisco Small Business 220 Series - Multiple Vulnerabilities remote, 2019-09-30

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Cisco Cisco Small Business 220 Series Smart Plus Switches

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.