CVE-2019-1686

mediumpriority · track · 35EPSS 0.016 · 75 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.59% (75th) EPSS

CVSS 5 · medium

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · scored 2026-10-27

A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect processing of the ACL applied to an interface of an affected device when Cisco Express Forwarding load balancing using the 3-tuple hash algorithm is enabled. An attacker could exploit this vulnerability by sending traffic through an affected device that should otherwise be denied by the configured ACL. An exploit could allow the attacker to bypass protection offered by a configured ACL on the affected device. There are workarounds that address this vulnerability. Affected Cisco IOS XR versions are: Cisco IOS XR Software Release 5.1.1 and later till first fixed. First Fixed Releases: 6.5.2 and later, 6.6.1 and later.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco ASR 9000 Series Aggregation Services Routers cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco IOS XR Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco ASR 9000 Series Aggregation Services Routers cisco_csaf
If the 5-tuple hash algorithm is used for load balancing, the device is not affected by the vulnerability described in this advisory. If the 3-tuple hash algorithm is required, enabling ACL compression for the ACL on the interface is a workaround for this vulnerability.
WorkaroundCisco IOS XR Softwarecisco_csaf
If the 5-tuple hash algorithm is used for load balancing, the device is not affected by the vulnerability described in this advisory. If the 3-tuple hash algorithm is required, enabling ACL compression for the ACL on the interface is a workaround for this vulnerability.

cvss

Technical severity, 0–10. One row per scoring source.

8.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.6

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 4

v3.05.8mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · ENISA EU

v3.05.8mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · psirt@cisco.com USexploitability 3.9 · impact 1.4

v3.05.8mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · Cisco PSIRT US

v3.18.6highAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

affected products (8)

Products and version ranges known to be affected.

Cisco Cisco ASR 9000 Series Aggregation Services Routers all versionscisco_csafUS
Cisco Cisco IOS XR Softwareall versionscisco_csafUS
Cisco Cisco IOS XR Softwareunspecified → 6.5.2enisa_euvdEU
Cisco Cisco IOS XR Softwareunspecified → 6.6.1enisa_euvdEU
Cisco Systems Inc. Cisco IOS XR5.1.1 → 6.5.2fstec_bduRU
Cisco Systems Inc. Cisco IOS XR6.5.3 → 6.6.1fstec_bduRU
cisco ios xr5.1.1 → 6.5.2nvdUScpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
cisco ios xr6.5.3 → 6.6.1nvdUScpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

cisco-sa-20190417-iosxraclCisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability2019-04-17csaf · cisco_csafUS
A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect processing of the ACL applied to an interface of an affected device when Cisco Express Forwarding load balancing using the 3-tuple hash algorithm is enabled. An attacker could exploit this vulnerability by sending traffic through an affected device that should otherwise be denied by the configured ACL. An exploit could allow the attacker to bypass protection offered by a configured ACL on the affected device. There are workarounds that address this vulnerability.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisco_csaf nvd NVD CVE.org MITRE

published 2019-04-17modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan