The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768…
Priority LOW 39CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previously used for an administrator's connection, aka Bug ID CSCux22492.
Why it matters now
EPSS 0.03379 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:asr_5000_series_software:16.5.2:*:*:*:*:*:*:* | 16.5.2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:asr_5000_series_software:17.7.0:*:*:*:*:*:*:* | 17.7.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:asr_5000_series_software:18.4.0:*:*:*:*:*:*:* | 18.4.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:asr_5000_series_software:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:asr_5000_series_software:19.3.0:*:*:*:*:*:*:* | 19.3.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:asr_5000_series_software:20.0.0:*:*:*:*:*:*:* | 20.0.0 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:asr_5000_series_software:16.5.2:*:*:*:*:*:*:* Versions 16.5.2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:asr_5000_series_software:17.7.0:*:*:*:*:*:*:* Versions 17.7.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:asr_5000_series_software:18.4.0:*:*:*:*:*:*:* Versions 18.4.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:asr_5000_series_software:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:asr_5000_series_software:19.3.0:*:*:*:*:*:*:* Versions 19.3.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:asr_5000_series_software:20.0.0:*:*:*:*:*:*:* Versions 20.0.0 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-1335
- 2026-10-03 Alias added: GHSA-8vpj-6xx8-gx4p
References
More Cisco Asr 5000 Series Software vulnerabilities
- TI-2017-02916 Access control flaw in Cisco StarOS CVSS 3.0HIGH 8.8
- TI-2017-04371 Memory corruption in Cisco ASR 5000 Series Aggregation Services Routers CVSS 3.0HIGH 8.6
- TI-2016-07532 Memory corruption in Cisco ASR 5000 CVSS 3.0HIGH 7.5
- TI-2016-05548 Resource management flaw in Cisco Aggregation Services Router 5000 Series Switch CVSS 3.0HIGH 7.5
- TI-2016-05547 Resource management flaw in Cisco StarOS 20.0.0 through 21.0.M0.64246 CVSS 3.0HIGH 7.5
- TI-2017-04430 Incorrect authorization in Cisco ASR 5000 Series Aggregation Services Routers CVSS 3.0HIGH 7.5
Sources
- CVE-2016-1335 · CVE Program
- CVE-2016-1335 · NVD
- FIRST EPSS
- GHSA-8vpj-6xx8-gx4p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences