{"schemaVersion":3,"id":"CVE-2019-1651","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the vContainer. An attacker could exploit this vulnerability by sending a malicious file to an affected vContainer instance. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected vContainer, which could result in a DoS condition that the attacker could use to execute arbitrary code as the root user.","dates":{"published":"2019-01-24T15:00:00.000Z","modified":"2024-11-20T17:28:19.180Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04853,"percentile":0.91936,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04853},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04853,"percentile":0.91936}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04853,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04853,"percentile":0.91936}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"cisco","product":"cisco sd-wan solution","name":"Cisco SD-WAN Solution","label":"cisco sd-wan solution","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"n/a","noFixRecorded":false,"fixedIn":null}],"versionsText":"n/a","eol":null,"hubHref":"/vendor/cisco/cisco_sd-wan_solution"},{"vendor":"cisco","product":"vsmart_controller","name":"vsmart controller","label":"vsmart_controller","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/vsmart_controller"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/106703","label":"www.securityfocus.com/bid/106703","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-sdwan-bo","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-sdwan-bo","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-01-24T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-20T17:28:19.180Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:57:31.619Z","stale":false,"partial":false}}