CVE-2019-12624

Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability

HIGH

8.8

CVSS Score

Published: August 21, 2019 at 06:05 PM UTC

Updated: June 17, 2026 at 02:14 AM UTC

19 products affected across 1 vendorIOS XeCatalyst 3850-24XsCatalyst 3850-Nm-2-40G

Using Cisco IOS XE Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XE Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 18%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xe · Cisco

95%

3.0.xe ≤ v ≤ 3.11.xe3.xE

cisco-5760-wireless-lan-controller (environment) · cisco-catalyst-3650-12x48uq (environment) · cisco-catalyst-3650-12x48ur (environment) · cisco-catalyst-3650-12x48uz (environment) · cisco-catalyst-3650-24pd (environment) · cisco-catalyst-3650-24pdm (environment) · cisco-catalyst-3650-48fq (environment) · cisco-catalyst-3650-48fqm (environment) · cisco-catalyst-3650-8x24uq (environment) · cisco-catalyst-3850-12x48u (environment) · cisco-catalyst-3850-24u (environment) · cisco-catalyst-3850-24xs (environment) · cisco-catalyst-3850-24xu (environment) · cisco-catalyst-3850-48u (environment) · cisco-catalyst-3850-48xs (environment) · cisco-catalyst-3850-nm-2-40g (environment) · cisco-catalyst-3850-nm-8-10g (environment) · cisco-catalyst-4500e-supervisor-engine-8-e (environment)

5760 Wireless Lan Controller · Ciscodevice

80%

All versions

Catalyst 3650-12X48Uq · Ciscodevice

80%

All versions

Catalyst 3650-12X48Ur · Ciscodevice

80%

All versions

Catalyst 3650-12X48Uz · Ciscodevice

80%

All versions