Cisco IOx Application Environment Denial of Service Vulnerability
Priority MEDIUM 42CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a denial of service (DoS) condition. The vulnerability is due to a Transport Layer Security (TLS) implementation issue. An attacker could exploit this vulnerability by sending crafted TLS packets to the IOx web server on an affected device. A successful exploit could allow the attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a DoS condition.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01824 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Industrial Routers Operating System Software | all versions | — | No fix listed | CNA |
- Cisco Industrial Routers Operating System Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:ios:1.6.0.0:*:*:*:*:*:*:* | 1.6.0.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ios:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:industrial_ethernet_2000_series_firmware:15.2\(6\)e:*:*:*:*:*:*:* | 15.2(6)e | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ie_2000-16ptc-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16t67:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16t67p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16tc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16tc-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16tc-g-e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-16tc-g-n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:ios:1.6.0.0:*:*:*:*:*:*:* Versions 1.6.0.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ios:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:industrial_ethernet_2000_series_firmware:15.2\(6\)e:*:*:*:*:*:*:* Versions 15.2(6)e Vulnerable ·Cisco
- cpe:2.3:h:cisco:ie_2000-16ptc-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16t67:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16t67p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16tc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16tc-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16tc-g-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-16tc-g-n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:ie_2000-16tc-g-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-24t67:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-4s-ts-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-4t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-4t-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-4ts:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-4ts-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8t67:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8t67p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8tc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8tc-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8tc-g-e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ie_2000-8tc-g-n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ic3000_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ic3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ie_4000_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ie_4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:cgr_1000_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:cgr_1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ir510_wpan_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ir510_wpan:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:ie_2000-16tc-g-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-24t67:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-4s-ts-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-4t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-4t-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-4ts:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-4ts-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8t67:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8t67p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8tc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8tc-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8tc-g-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ie_2000-8tc-g-n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ic3000_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:ic3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ie_4000_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:ie_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:cgr_1000_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:cgr_1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ir510_wpan_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:ir510_wpan:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12656
- 2026-10-03 Alias added: GHSA-6r46-67j7-hr8v
References
Sources
- CVE-2019-12656 · CVE Program
- CVE-2019-12656 · NVD
- FIRST EPSS
- GHSA-6r46-67j7-hr8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences