Read the docs
TI-2019-01224 Aliases CVE-2019-1597GHSA-c864-jx3f-89v5

Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities

Priority MEDIUM 48CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload, resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201, 2.2.2.54 and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(1). Cisco UCS 6200 and 6300 Fabric Interconnect devices are affected in versions prior to 3.2(2b).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0254 85th percentileScored 2026-11-07
Fix Fixed Firepower 4100 Series Next-Generation Firewalls (Cisco): 2.0.1.201, 2.2.2.54, 2.3.1.75Firepower 9300 Security Appliance (Cisco): 2.0.1.201, 2.2.2.54, 2.3.1.75+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoFirepower 4100 Series Next-Generation Firewallsbefore 2.0.1.201; before 2.2.2.54; before 2.3.1.752.0.1.201, 2.2.2.54, 2.3.1.75Patch availableCNA
CiscoFirepower 9300 Security Appliancebefore 2.0.1.201; before 2.2.2.54; before 2.3.1.752.0.1.201, 2.2.2.54, 2.3.1.75Patch availableCNA
CiscoMDS 9000 Series Multilayer Switchesbefore 8.2(1)8.2(1)Patch availableCNA
CiscoNexus 3000 Series Switchesbefore 7.0(3)I7(1)7.0(3)I7(1)Patch availableCNA
CiscoNexus 3500 Platform Switchesbefore 7.0(3)I7(2)7.0(3)I7(2)Patch availableCNA
CiscoNexus 7000 and 7700 Series Switchesbefore 8.2(1)8.2(1)Patch availableCNA
CiscoNexus 9000 Series Switches in Standalone NX-OS Modebefore 7.0(3)I7(1)7.0(3)I7(1)Patch availableCNA
CiscoCisco UCS 6200 and 6300 Fabric Interconnectbefore 3.2(2b)3.2(2b)Patch availableCNA
  • Firepower 4100 Series Next-Generation Firewalls VendorCisco Affected before 2.0.1.201; before 2.2.2.54; before 2.3.1.75 Fixed in 2.0.1.201, 2.2.2.54, 2.3.1.75 Patch available CNA
  • Firepower 9300 Security Appliance VendorCisco Affected before 2.0.1.201; before 2.2.2.54; before 2.3.1.75 Fixed in 2.0.1.201, 2.2.2.54, 2.3.1.75 Patch available CNA
  • MDS 9000 Series Multilayer Switches VendorCisco Affected before 8.2(1) Fixed in 8.2(1) Patch available CNA
  • Nexus 3000 Series Switches VendorCisco Affected before 7.0(3)I7(1) Fixed in 7.0(3)I7(1) Patch available CNA
  • Nexus 3500 Platform Switches VendorCisco Affected before 7.0(3)I7(2) Fixed in 7.0(3)I7(2) Patch available CNA
  • Nexus 7000 and 7700 Series Switches VendorCisco Affected before 8.2(1) Fixed in 8.2(1) Patch available CNA
  • Nexus 9000 Series Switches in Standalone NX-OS Mode VendorCisco Affected before 7.0(3)I7(1) Fixed in 7.0(3)I7(1) Patch available CNA
  • Cisco UCS 6200 and 6300 Fabric Interconnect VendorCisco Affected before 3.2(2b) Fixed in 3.2(2b) Patch available CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*after 2.2.2.54, before 2.3.1.75VulnerableCisco
cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*before 8.2\(1\)VulnerableCisco
cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*before 7.0\(3\)i7\(1\)VulnerableCisco
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*before 7.0\(3\)i7\(2\)VulnerableCisco
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*after 7.3\(2\)d1\(1\), before 8.2\(1\)VulnerableCisco
  • cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* Versions after 2.2.2.54, before 2.3.1.75 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions before 8.2\(1\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions before 7.0\(3\)i7\(1\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions before 7.0\(3\)i7\(2\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions after 7.3\(2\)d1\(1\), before 8.2\(1\) Vulnerable ·Cisco
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*after 2.0.1.201, before 2.2.2.54VulnerableCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*after 6.2\(20\), before 7.3\(2\)d1\(1\); before 6.2\(20\)VulnerableCisco
cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*before 2.0.1.201VulnerableCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*before 3.2\(2b\)VulnerableCisco
cpe:2.3:h:cisco:ucs_6200:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:ucs_6300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* Versions after 2.0.1.201, before 2.2.2.54 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions after 6.2\(20\), before 7.3\(2\)d1\(1\); before 6.2\(20\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* Versions before 2.0.1.201 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions before 3.2\(2b\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ucs_6200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:ucs_6300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

  • Fix · CNA Firepower 4100 Series Next-Generation Firewalls (Cisco) Fixed in 2.0.1.201, 2.2.2.54, 2.3.1.75
  • Fix · CNA Firepower 9300 Security Appliance (Cisco) Fixed in 2.0.1.201, 2.2.2.54, 2.3.1.75
  • Fix · CNA MDS 9000 Series Multilayer Switches (Cisco) Fixed in 8.2(1)
  • Fix · CNA Nexus 3000 Series Switches (Cisco) Fixed in 7.0(3)I7(1)
  • Fix · CNA Nexus 3500 Platform Switches (Cisco) Fixed in 7.0(3)I7(2)
  • Fix · CNA Nexus 7000 and 7700 Series Switches (Cisco) Fixed in 8.2(1)
  • Fix · CNA Nexus 9000 Series Switches in Standalone NX-OS Mode (Cisco) Fixed in 7.0(3)I7(1)
  • Fix · CNA Cisco UCS 6200 and 6300 Fabric Interconnect (Cisco) Fixed in 3.2(2b)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Cisco Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance and 5 more products — 20190306 Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2019-01225 Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service VulnerabilitiesPriority MEDIUM 48
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1597
  2. 2026-10-03 Alias added: GHSA-c864-jx3f-89v5

References

Patch 1

  • TI-2018-00269 Resource management flaw in Cisco FXOS and NX-OS unknown CVSS 3.0CRITICAL 9.8
  • TI-2015-05417 An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco… CVSS 3.0CRITICAL 9.8
  • TI-2019-01480 Cisco FXOS and NX-OS Software Simple Network Management Protocol Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2019-01225 Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities CVSS 3.0HIGH 8.6
  • TI-2020-03063 Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2017-09053 Improper input validation in Cisco Firepower 4100 Series NGFW and Firepower 9300 Security… CVSS 3.0HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences