© 2026 vulntracker.io

CVE-2019-1748

Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation Vulnerability

HIGH

7.4

CVSS Score

Published: March 27, 2019 at 11:50 PM UTC

Updated: June 17, 2026 at 02:29 AM UTC

2 products affected across 1 vendorIOSIOS Xe

Using Cisco IOS and IOS XE Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS and IOS XE Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 1%

Description

A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt and modify confidential information on user connections to the affected software.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS · Cisconpm

95%

12.0(1)12.0(1)t 12.0(1)t1 12.0(1)xe 12.0(10)12.0(10)s 12.0(10)s1 12.0(10)s2 12.0(10)s3 12.0(10)s3b 12.0(10)s4 12.0(10)s5 12.0(10)s6 12.0(10)s7 12.0(10)s8 12.0(10)st 12.0(10)st1 12.0(10)st2 12.0(10a)12.0(11)12.0(11)s 12.0(11)s1 12.0(11)s2 12.0(11)s3 12.0(11)s4 12.0(11)s5 12.0(11)s6 12.0(11)st 12.0(11)st1 12.0(11)st2 12.0(11)st3 12.0(11)st4 12.0(11a)12.0(12)12.0(12a)12.0(13)12.0(13a)12.0(14)12.0(14a)12.0(15)12.0(15a)12.0(15b)12.0(16)12.0(16a)12.0(16b)12.0(17)12.0(17a)12.0(18)12.0(18b)12.0(19)12.0(19a)12.0(19b)12.0(1a)12.0(2)12.0(2)s 12.0(2)t 12.0(2)t1 12.0(2)xe 12.0(2)xe1 12.0(2)xe3 12.0(2)xe4 12.0(20)12.0(20a)12.0(21)12.0(21a)12.0(22)12.0(23)12.0(24)12.0(25)12.0(26)12.0(27)12.0(28)12.0(28)s4a 12.0(28a)12.0(28b)12.0(28c)12.0(28d)12.0(2a)12.0(2a)t1 12.0(2b)12.0(3)12.0(3)s 12.0(3)t 12.0(3)t2 12.0(3)t3 12.0(31)sz2 12.0(3a)12.0(3b)12.0(3c)12.0(3d)12.0(4)12.0(4)s 12.0(4)t 12.0(4)xe 12.0(4)xe2 12.0(4a)12.0(4b)12.0(5)12.0(5)s 12.0(5)t 12.0(5)t1 12.0(5)xe 12.0(5)xe1 12.0(5)xe2 12.0(5)xe3 12.0(5)xe4 12.0(5)xe5 12.0(5)xe8 12.0(5)xt1 12.0(5a)12.0(6)12.0(6)s 12.0(6)s1 12.0(6)s2 12.0(6a)12.0(6b)12.0(7)12.0(7)s 12.0(7)s1 12.0(7)t 12.0(7)t1 12.0(7)t2 12.0(7)t3 12.0(7)xk 12.0(7)xk1 12.0(7a)12.0(8)12.0(8)s 12.0(8)s1 12.0(8a)12.0(8b)12.0(9)12.0(9)s 12.0(9)s8 12.0(9)st 12.0(9a)12.1(1)12.1(1)t 12.1(10)12.1(10a)12.1(11)12.1(11b)12.1(12)12.1(12a)12.1(12b)12.1(13)12.1(13a)12.1(14)12.1(15)12.1(16)12.1(17)12.1(17a)12.1(18)12.1(19)12.1(19)ea1b 12.1(19)ea1c 12.1(1c)12.1(2)12.1(2)t 12.1(20)12.1(20)ea1 12.1(20)ea1a 12.1(20)ea1b 12.1(20)ea2 12.1(20a)12.1(21)12.1(22)12.1(22)ea1a 12.1(22)ea4 12.1(22)ea4a 12.1(22)ea6 12.1(22a)12.1(22b)12.1(22c)12.1(24)12.1(25)12.1(26)12.1(2b)12.1(3)12.1(3)t 12.1(3)xi 12.1(3b)12.1(4)12.1(4a)12.1(4b)12.1(4c)12.1(5)12.1(5)t 12.1(5)t10 12.1(5)t12 12.1(5)t13 12.1(5)t15 12.1(5)t17 12.1(5)t18 12.1(5)t19 12.1(5)t4 12.1(5)t5 12.1(5)t7 12.1(5)t8 12.1(5)t8c 12.1(5)t9 12.1(5)yb 12.1(5)yb2 12.1(5a)e5 12.1(5a)e6 12.1(5b)12.1(5c)12.1(5c)e11 12.1(5c)ex 12.1(5c)ex1 12.1(5e)12.1(6)12.1(6)e 12.1(6)e12 12.1(6)e8 12.1(6)ea1a 12.1(6)ea2 12.1(6)ea2a 12.1(6)ea2b 12.1(6)ea2c 12.1(6)ex 12.1(6a)12.1(6b)12.1(7)12.1(7a)e5 12.1(7b)12.1(7c)12.1(8)12.1(8)ea1b 12.1(8a)12.1(8a)e 12.1(8b)e12 12.1(8b)e13 12.1(8b)e15 12.1(8b)e19 12.1(8b)e20 12.1(8b)e9 12.1(8b)ex4 12.1(8c)12.1(9)12.1(9)ea1a 12.1(9)ea1c 12.1(9)ea1d 12.1(9)ex 12.1(9a)12.2(1)12.2(10)12.2(10a)12.2(10b)12.2(10d)12.2(10g)12.2(11)yz 12.2(11)yz1 12.2(11)yz2 12.2(11)yz3 12.2(12)12.2(12a)12.2(12b)12.2(12b)m1 12.2(12c)12.2(12d)12.2(12e)12.2(12f)12.2(12g)12.2(12h)12.2(12h)m1 12.2(12i)12.2(12j)12.2(12k)12.2(12l)12.2(12m)12.2(13)12.2(13a)12.2(13b)12.2(13b)m1 12.2(13b)m2 12.2(13c)12.2(13e)12.2(14)sz 12.2(14)sz1 12.2(14)sz2 12.2(14)sz3 12.2(14)sz4 12.2(14)sz5 12.2(14)sz6 12.2(16)12.2(16a)12.2(16b)12.2(16c)12.2(16f)12.2(17)12.2(17a)12.2(17b)12.2(17d)12.2(17e)12.2(17f)12.2(18)s 12.2(18)s1 12.2(18)s2 12.2(18)s3 12.2(18)s4 12.2(19)12.2(19a)12.2(19b)12.2(19c)12.2(1a)12.2(1b)12.2(1d)12.2(2)xb9 12.2(20)s 12.2(20)s1 12.2(20)s2 12.2(20)s2a 12.2(20)s3 12.2(20)s4 12.2(20)s4a 12.2(20)s5 12.2(20)s6 12.2(21)12.2(21a)12.2(21b)12.2(22)s 12.2(23)12.2(23a)12.2(23c)12.2(23d)12.2(23e)12.2(23f)12.2(24)12.2(24a)12.2(24b)12.2(25)s 12.2(25)s1 12.2(25)s2 12.2(25)se 12.2(26)12.2(26a)12.2(26b)12.2(27)12.2(27)sbk9 12.2(27a)12.2(27b)12.2(28)12.2(28a)12.2(28b)12.2(28c)12.2(28d)12.2(29)12.2(29a)12.2(3)12.2(31)12.2(32)12.2(37)12.2(3d)12.2(3g)12.2(4)xl2 12.2(40)12.2(40a)12.2(46)12.2(5)12.2(5a)12.2(5d)12.2(6)12.2(6a)12.2(6b)12.2(6c)12.2(6d)12.2(6e)12.2(6f)12.2(6g)12.2(6h)12.2(6i)12.2(6j)12.2(7)12.2(7a)12.2(7b)12.2(7c)12.2(7g)12.2(8)zb 12.2(9)yo 12.2(9)yo1 12.2(9)yo2 12.2(9)yo3 12.2(9)yo4 12.3(11)ja2 12.3(11)jx 12.3(11)jx1 12.3(11)yf2 12.3(2)ja3 12.3(2)ja4 12.3(7)jx9 12.3(7)xi3a 12.3(8)jk 12.3(9)m0 12.3(9)m1 12.4(11)md2 12.4(23c)jy 15.0(1)ey 15.0(1)ey2 15.0(2)ex2 15.0(2)ex8 15.0(2)se1315.0(2)sqd815.0(2)sqd9 15.1(2)sg8a 15.1(3)mra3 15.1(3)svg3d 15.1(3)svi1b 15.1(3)svk4b 15.1(3)svk4c 15.1(3)svo1 15.1(3)svo2 15.1(3)svp1 15.2(1)e 15.2(1)e1 15.2(1)e2 15.2(1)e3 15.2(1)ey 15.2(1)sy 15.2(1)sy0a 15.2(1)sy1 15.2(1)sy1a 15.2(1)sy2 15.2(1)sy3 15.2(1)sy415.2(1)sy515.2(1)sy615.2(1)sy715.2(2)e 15.2(2)e1 15.2(2)e10 15.2(2)e2 15.2(2)e3 15.2(2)e4 15.2(2)e5 15.2(2)e5a 15.2(2)e5b 15.2(2)e6 15.2(2)e7 15.2(2)e7b 15.2(2)e8 15.2(2)e9 15.2(2)e9a 15.2(2)ea 15.2(2)ea1 15.2(2)ea2 15.2(2)ea3 15.2(2)eb 15.2(2)eb1 15.2(2)eb2 15.2(2)sc1 15.2(2)sc3 15.2(2)sc4 15.2(2)sy 15.2(2)sy1 15.2(2)sy215.2(2)sy315.2(2a)e1 15.2(2a)e2 15.2(2b)e 15.2(3)e 15.2(3)e1 15.2(3)e2 15.2(3)e3 15.2(3)e4 15.2(3)e5 15.2(3)ea 15.2(3)ea1 15.2(3a)e 15.2(3m)e2 15.2(3m)e7 15.2(3m)e8 15.2(4)e 15.2(4)e1 15.2(4)e2 15.2(4)e3 15.2(4)e4 15.2(4)e5 15.2(4)e5a 15.2(4)e6 15.2(4)ea 15.2(4)ea1 15.2(4)ea2 15.2(4)ea3 15.2(4)ea4 15.2(4)ea5 15.2(4)ea6 15.2(4)ea7 15.2(4)ec1 15.2(4)ec2 15.2(4)jaz1 15.2(4a)ea5 15.2(4m)e1 15.2(4m)e2 15.2(4m)e3 15.2(4n)e2 15.2(4o)e2 15.2(4o)e3 15.2(4p)e1 15.2(4q)e1 15.2(4s)e1 15.2(4s)e2 15.2(5)e 15.2(5)e115.2(5)e215.2(5)e2b 15.2(5)e2c 15.2(5)ea 15.2(5)ex 15.2(5a)e 15.2(5a)e1 15.2(5b)e 15.2(5c)e 15.2(6)e 15.2(6)e0a 15.2(6)e0b15.2(6)e0c15.3(0)sy 15.3(1)sy 15.3(1)sy1 15.3(1)sy2 15.3(1)sy3 15.3(2)s 15.3(2)s1 15.3(2)s2 15.3(3)jaa1 15.3(3)jc 15.3(3)jc1 15.3(3)jc14 15.3(3)jc2 15.3(3)jc3 15.3(3)jc4 15.3(3)jc5 15.3(3)jc6 15.3(3)jc8 15.3(3)jc9 15.3(3)jd 15.3(3)jd11 15.3(3)jd12 15.3(3)jd13 15.3(3)jd14 15.3(3)jd15 15.3(3)jd16 15.3(3)jd2 15.3(3)jd3 15.3(3)jd4 15.3(3)jd5 15.3(3)jd6 15.3(3)jd7 15.3(3)jd8 15.3(3)jd9 15.3(3)je 15.3(3)jf 15.3(3)jf1 15.3(3)jf2 15.3(3)jf35 15.3(3)jf4 15.3(3)jf5 15.3(3)jf6 15.3(3)jf7 15.3(3)jf8 15.3(3)jf9 15.3(3)jg 15.3(3)jg1 15.3(3)jh 15.3(3)jh1 15.3(3)ji 15.3(3)ji1 15.3(3)ji2 15.3(3)s 15.3(3)s1 15.3(3)s10 15.3(3)s1a 15.3(3)s2 15.3(3)s2a 15.3(3)s3 15.3(3)s4 15.3(3)s5 15.3(3)s6 15.3(3)s6a 15.3(3)s7 15.3(3)s8 15.3(3)s8a 15.3(3)s9 15.4(1)cg 15.4(1)cg1 15.4(1)s 15.4(1)s1 15.4(1)s2 15.4(1)s3 15.4(1)s4 15.4(1)sy 15.4(1)sy1 15.4(1)sy215.4(1)sy315.4(1)t 15.4(1)t1 15.4(1)t2 15.4(1)t3 15.4(1)t4 15.4(2)cg 15.4(2)s 15.4(2)s1 15.4(2)s2 15.4(2)s3 15.4(2)s4 15.4(2)sn 15.4(2)sn1 15.4(2)t 15.4(2)t1 15.4(2)t2 15.4(2)t3 15.4(2)t4 15.4(3)m 15.4(3)m1 15.4(3)m10 15.4(3)m2 15.4(3)m3 15.4(3)m4 15.4(3)m5 15.4(3)m6 15.4(3)m6a 15.4(3)m7 15.4(3)m7a 15.4(3)m8 15.4(3)m9 15.4(3)s 15.4(3)s0d 15.4(3)s0e 15.4(3)s0f 15.4(3)s1 15.4(3)s2 15.4(3)s3 15.4(3)s4 15.4(3)s5 15.4(3)s6 15.4(3)s6a 15.4(3)s7 15.4(3)s8 15.4(3)s9 15.4(3)sn1 15.4(3)sn1a 15.5(1)s 15.5(1)s1 15.5(1)s2 15.5(1)s3 15.5(1)s4 15.5(1)sn 15.5(1)sn1 15.5(1)sy 15.5(1)t 15.5(1)t1 15.5(1)t2 15.5(1)t3 15.5(1)t4 15.5(2)s 15.5(2)s1 15.5(2)s2 15.5(2)s3 15.5(2)s4 15.5(2)sn 15.5(2)t 15.5(2)t1 15.5(2)t2 15.5(2)t3 15.5(2)t4 15.5(2)xb 15.5(3)m 15.5(3)m0a 15.5(3)m1 15.5(3)m2 15.5(3)m2a 15.5(3)m3 15.5(3)m4 15.5(3)m4a 15.5(3)m4b 15.5(3)m4c 15.5(3)m5 15.5(3)m5a 15.5(3)m6 15.5(3)m6a 15.5(3)m7 15.5(3)s 15.5(3)s0a 15.5(3)s1 15.5(3)s1a 15.5(3)s2 15.5(3)s3 15.5(3)s4 15.5(3)s5 15.5(3)s6 15.5(3)s6a 15.5(3)s6b 15.5(3)s7 15.5(3)s7a 15.5(3)s7b 15.5(3)sn 15.5(3)sn0a 15.6(1)s 15.6(1)s1 15.6(1)s2 15.6(1)s3 15.6(1)s4 15.6(1)sn 15.6(1)sn1 15.6(1)sn2 15.6(1)sn3 15.6(1)t 15.6(1)t0a 15.6(1)t1 15.6(1)t2 15.6(1)t3 15.6(2)s 15.6(2)s0a 15.6(2)s1 15.6(2)s2 15.6(2)s3 15.6(2)s4 15.6(2)sn 15.6(2)sp 15.6(2)sp1 15.6(2)sp2 15.6(2)sp3 15.6(2)sp3b 15.6(2)sp4 15.6(2)sp5 15.6(2)t 15.6(2)t0a 15.6(2)t1 15.6(2)t2 15.6(2)t3 15.6(3)m 15.6(3)m0a 15.6(3)m1 15.6(3)m1a 15.6(3)m1b 15.6(3)m2 15.6(3)m2a 15.6(3)m3 15.6(3)m3a 15.6(3)m4 15.6(3)sn 15.6(4)sn 15.6(5)sn 15.6(6)sn 15.6(7)sn 15.7(3)m 15.7(3)m0a 15.7(3)m1

IOS Xe · Cisco

95%

16.1.1 16.1.2 16.1.3 16.2.1 16.2.2 16.3.1 16.3.1a 16.3.2 16.3.3 16.3.4 16.3.5 16.3.5b 16.4.1 16.4.2 16.4.3 16.5.1 16.5.1a 16.5.1b 16.5.2 16.6.1 16.6.23.10.0E3.10.0S3.10.0cE3.10.0ce 3.10.0e 3.10.0s3.10.10S3.10.10s3.10.1S3.10.1s3.10.2S3.10.2aS3.10.2as 3.10.2s3.10.2tS3.10.2ts3.10.3S3.10.3s3.10.4S3.10.4s3.10.5S3.10.5s3.10.6S3.10.6s3.10.7S3.10.7s3.10.8S3.10.8aS3.10.8as 3.10.8s3.10.9S3.10.9s3.11.0S3.11.0s3.11.1S3.11.1s3.11.2S3.11.2s3.11.3S3.11.3s3.11.4S3.11.4s3.12.0S3.12.0aS3.12.0as 3.12.0s3.12.1S3.12.1s3.12.2S3.12.2s3.12.3S3.12.3s3.12.4S3.12.4s3.13.0S3.13.0aS3.13.0as 3.13.0s3.13.1S3.13.1s3.13.2S3.13.2aS3.13.2as 3.13.2s3.13.3S3.13.3s3.13.4S3.13.4s3.13.5S3.13.5aS3.13.5as 3.13.5s3.13.6S3.13.6aS3.13.6as3.13.6bS3.13.6bs 3.13.6s3.13.7S3.13.7aS3.13.7as 3.13.7s3.13.8S3.13.8s3.13.9S3.13.9s3.14.0S3.14.0s3.14.1S3.14.1s3.14.2S3.14.2s3.14.3S3.14.3s3.14.4S3.14.4s3.15.0S3.15.0s3.15.1S3.15.1cS3.15.1cs 3.15.1s3.15.2S3.15.2s3.15.3S3.15.3s3.15.4S3.15.4s3.16.0S3.16.0aS3.16.0as3.16.0bS3.16.0bs3.16.0cS3.16.0cs 3.16.0s3.16.1S3.16.1aS3.16.1as 3.16.1s3.16.2S3.16.2aS3.16.2as3.16.2bS3.16.2bs 3.16.2s3.16.3S3.16.3aS3.16.3as 3.16.3s3.16.4S3.16.4aS3.16.4as3.16.4bS3.16.4bs3.16.4cS3.16.4cs3.16.4dS3.16.4ds3.16.4eS3.16.4es3.16.4gS3.16.4gs 3.16.4s3.16.5S3.16.5aS3.16.5as3.16.5bS3.16.5bs 3.16.5s3.16.6S3.16.6bS3.16.6bs 3.16.6s3.16.7S3.16.7aS3.16.7as 3.16.7s3.17.0S3.17.0s3.17.1S3.17.1aS3.17.1as 3.17.1s3.17.2S3.17.3S3.17.3s3.17.4S3.17.4s3.18.0S3.18.0SP3.18.0aS3.18.0as 3.18.0s 3.18.0sp3.18.1S3.18.1SP3.18.1aSP3.18.1asp3.18.1bSP3.18.1bsp3.18.1cSP3.18.1csp3.18.1gSP3.18.1gsp3.18.1hSP3.18.1hsp3.18.1iSP3.18.1isp 3.18.1s 3.18.1sp3.18.2S3.18.2SP3.18.2aSP3.18.2asp 3.18.2s 3.18.2sp3.18.3S3.18.3SP3.18.3aSP3.18.3asp3.18.3bSP3.18.3bsp 3.18.3s 3.18.3sp3.18.4S3.18.4SP3.18.4s 3.18.4sp3.18.5SP3.18.5sp3.3.0SE3.3.0XO3.3.0se 3.3.0xo3.3.1SE3.3.1XO3.3.1se 3.3.1xo3.3.2SE3.3.2XO3.3.2se 3.3.2xo3.3.3SE3.3.3se3.3.4SE3.3.4se3.3.5SE3.3.5se3.5.0E3.5.0e3.5.1E3.5.1e3.5.2E3.5.2e3.5.3E3.5.3e3.6.0E3.6.0aE3.6.0ae3.6.0bE3.6.0be 3.6.0e3.6.10E3.6.10e3.6.1E3.6.1e3.6.2E3.6.2aE3.6.2ae 3.6.2e3.6.3E3.6.3e3.6.4E3.6.4e3.6.5E3.6.5aE3.6.5ae3.6.5bE3.6.5be 3.6.5e3.6.6E3.6.6e3.6.7E3.6.7aE3.6.7ae3.6.7bE3.6.7be 3.6.7e3.6.9E3.6.9aE3.6.9ae 3.6.9e3.7.0E3.7.0e3.7.1E3.7.1e3.7.2E3.7.2e3.7.3E3.7.3e3.7.4E3.7.4e3.7.5E3.7.5e3.7.7S3.7.7s3.8.0E3.8.0e3.8.1E3.8.1e3.8.2E3.8.2e3.8.3E3.8.3e3.8.4E3.8.4e3.8.5E3.8.5aE3.8.5ae 3.8.5e3.8.6E3.8.6e3.9.0E3.9.0S3.9.0aS3.9.0as 3.9.0e 3.9.0s3.9.1E3.9.1S3.9.1aS3.9.1as 3.9.1e 3.9.1s 3.9.2E3.9.2S3.9.2bE3.9.2be3.9.2e3.9.2s

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-pnp-cert

References (2)

VDB Entryx_refsource_BIDThird Party Advisory

Source: [email protected]

http://www.securityfocus.com/bid/107619

Vendor Advisoryx_refsource_CISCOPatch

Source: [email protected]

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-pnp-cert

CVSS

7.4HIGH[email protected]

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card