TI-2019-01491 Aliases CVE-2019-1869 GHSA-r863-66v2-rjq3

Cisco StarOS Denial of Service Vulnerability

MEDIUM 48CWE-824Published 2019-06-20 · Updated 2024-11-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.

Summary

A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service interface from receiving any traffic, which would lead to a DoS condition on the affected interface. The device may have to be manually reloaded to recover from exploitation of this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0264 85th percentileScored 2026-11-07

Fix Fixed Cisco ASR 5000 Series Software (Cisco): 21.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco ASR 5000 Series Software	before 21.11.1	21.11.1	Patch available	CNA

Cisco ASR 5000 Series Software VendorCisco Affected before 21.11.1 Fixed in 21.11.1 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:staros::::::::	21.6 to before 21.6.13; 21.6b to before 21.6b.16; 21.7 to before 21.7.11; 21.8 to before 21.8.10; 21.9 to before 21.9.7; 21.10 to before 21.10.2; 21.11 to before 21.11.1	Vulnerable	Cisco
cpe:2.3:h:cisco:asr_5000:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:h:cisco:asr_5500:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:h:cisco:asr_5700:-:::::::*	not specified by NVD	Running on	Cisco

cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:* Versions 21.6 to before 21.6.13; 21.6b to before 21.6b.16; 21.7 to before 21.7.11; 21.8 to before 21.8.10; 21.9 to before 21.9.7; 21.10 to before 21.10.2; 21.11 to before 21.11.1 Vulnerable ·Cisco
cpe:2.3:h:cisco:asr_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:h:cisco:asr_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:h:cisco:asr_5700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

Fix · CNA Cisco ASR 5000 Series Software (Cisco) Fixed in 21.11.1

Timeline

2026-10-02 Threatist record created from CVE-2019-1869
2026-10-03 Alias added: GHSA-r863-66v2-rjq3

References

Advisory 1

20190619 Cisco StarOS Denial of Service Vulnerability

TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2018-00328 Improper input validation in Cisco StarOS unknown CVSS 3.0HIGH 8.6
TI-2021-01080 Cisco StarOS IPv4 Denial of Service Vulnerability CVSS 3.1HIGH 8.6
TI-2018-00201 Improper input validation in Cisco StarOS CVSS 3.1HIGH 7.5
TI-2021-01105 Cisco StarOS Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2023-06755 Insufficiently protected credentials in Cisco ASR 5000 Series Software CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences