CVE-2019-1710
highpriority · track · 40EPSS 0.028 · 86 %ileEURUUSEPSS · scored 2026-10-27
A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCisco ASR 9000 Series Aggregation Services Routers cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco IOS XR Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco ASR 9000 Series Aggregation Services Routers cisco_csaf
Customers can perform the following workaround, which is equivalent to upgrading to a fixed software release. Although the reload of the sysadmin VM is hitless, Cisco recommends performing this change during a maintenance window: Step 1: Access the sysadmin VM: RP/0/RSP1/CPU0:eXR#admin Tue Mar 12 22:46:37.110 UTC root connected from 127.0.0.1 using console on host Step 2: Run bash and edit the calvados_bootstrap.cfg file: sysadmin-vm:0_RSP1:eXR# run bash Tue Mar 12 22:46:44.224 UTC bash-4.3# vi /etc/init.d/calvados_bootstrap.cfg Step 3: Edit the file by changing: #CTRL_VRF=0 #MGMT_VRF=2 To: CTRL_VRF=0 MGMT_VRF=2 Exit the file and save. In dual RSP/RP systems, the edit must be performed on both active and standby RSP/RPs. Step 4: Reload the sysadmin VM (repeat for both in dual systems): sysadmin-vm:0_RSP1:eXR# reload admin location 0/RSP1 Tue Mar 12 22:49:28.589 UTC Reload node ? [no,yes] yes result Admin VM graceful reload request on 0/RSP1 succeeded. sysadmin-vm:0_RSP1:eXR# RP/0/RSP1/CPU0:Mar 12 22:49:34.059 UTC: rmf_svr[402]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :RP-RED-LOST-ADMINNR :DECLARE :0/RSP1/CPU0: Confd is down RP/0/RSP1/CPU0:eXR# Wait till the admin VM returns: RP/0/RSP1/CPU0:eXR#0/RSP1/ADMIN0:Mar 12 22:59:30.220 UTC: envmon[3680]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :Power Module redundancy lost :DECLARE :0: RP/0/RSP1/CPU0:Mar 12 22:59:33.708 UTC: rmf_svr[402]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :RP-RED-LOST-ADMINNR :CLEAR :0/RSP1/CPU0:
- WorkaroundCisco IOS XR Softwarecisco_csaf
Customers can perform the following workaround, which is equivalent to upgrading to a fixed software release. Although the reload of the sysadmin VM is hitless, Cisco recommends performing this change during a maintenance window: Step 1: Access the sysadmin VM: RP/0/RSP1/CPU0:eXR#admin Tue Mar 12 22:46:37.110 UTC root connected from 127.0.0.1 using console on host Step 2: Run bash and edit the calvados_bootstrap.cfg file: sysadmin-vm:0_RSP1:eXR# run bash Tue Mar 12 22:46:44.224 UTC bash-4.3# vi /etc/init.d/calvados_bootstrap.cfg Step 3: Edit the file by changing: #CTRL_VRF=0 #MGMT_VRF=2 To: CTRL_VRF=0 MGMT_VRF=2 Exit the file and save. In dual RSP/RP systems, the edit must be performed on both active and standby RSP/RPs. Step 4: Reload the sysadmin VM (repeat for both in dual systems): sysadmin-vm:0_RSP1:eXR# reload admin location 0/RSP1 Tue Mar 12 22:49:28.589 UTC Reload node ? [no,yes] yes result Admin VM graceful reload request on 0/RSP1 succeeded. sysadmin-vm:0_RSP1:eXR# RP/0/RSP1/CPU0:Mar 12 22:49:34.059 UTC: rmf_svr[402]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :RP-RED-LOST-ADMINNR :DECLARE :0/RSP1/CPU0: Confd is down RP/0/RSP1/CPU0:eXR# Wait till the admin VM returns: RP/0/RSP1/CPU0:eXR#0/RSP1/ADMIN0:Mar 12 22:59:30.220 UTC: envmon[3680]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :Power Module redundancy lost :DECLARE :0: RP/0/RSP1/CPU0:Mar 12 22:59:33.708 UTC: rmf_svr[402]: %PKT_INFRA-FM-3-FAULT_MAJOR : ALARM_MAJOR :RP-RED-LOST-ADMINNR :CLEAR :0/RSP1/CPU0:
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- cisco-sa-20190417-asr9k-exrCisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability2019-04-17csaf · cisco_csafUS
A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://www.cisco.com/cnnvd
- http://www.securityfocus.com/bid/108007cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-1710cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exrcnnvd
- https://vigilance.fr/vulnerability/Cisco-IOS-XR-ASR-9000-privilege-escalation-via-Management-Interface-Isolation-29081cnnvd
- https://www.auscert.org.au/bulletins/79286cnnvd
- https://www.securityfocus.com/bid/108007cnnvd
- http://www.securityfocus.com/bid/108007enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan