CVE-2019-1891
Cisco Small Business Series Switches HTTP Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.5
Cisco Small Business Series Switches HTTP Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition.
- Record
CVE-2019-1891- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2019-10448
7.5
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition.
- Record
EUVD-2019-10448- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jqq-2p4j-9fgf
7.5
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed...
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition.
- Record
GHSA-8jqq-2p4j-9fgf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
7.5
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition.
- Record
CVE-2019-1891- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- cisco small business 300 series managed switches
- cisco esw2-350g52dc firmware
- cisco esw2-550x48dc firmware
- cisco sf200-24 firmware
- cisco sf200-24p firmware
- cisco sf200-48 firmware
- cisco sf200-48p firmware
- cisco sf300-08 firmware
- cisco sf300-24 firmware
- cisco sf300-24mp firmware
- cisco sf300-24p firmware
- cisco sf300-24pp firmware
Show 46 moreShow less
- cisco sf300-48 firmware
- cisco sf300-48p firmware
- cisco sf300-48pp firmware
- cisco sf302-08 firmware
- cisco sf302-08mp firmware
- cisco sf302-08mpp firmware
- cisco sf302-08p firmware
- cisco sf302-08pp firmware
- cisco sf500-24 firmware
- cisco sf500-24mp firmware
- cisco sf500-24p firmware
- cisco sf500-48 firmware
- cisco sf500-48mp firmware
- cisco sf500-48p firmware
- cisco sg200-18 firmware
- cisco sg200-26 firmware
- cisco sg200-26p firmware
- cisco sg200-50 firmware
- cisco sg200-50p firmware
- cisco sg300-10 firmware
- cisco sg300-10mp firmware
- cisco sg300-10mpp firmware
- cisco sg300-10p firmware
- cisco sg300-10pp firmware
- cisco sg300-10sfp firmware
- cisco sg300-20 firmware
- cisco sg300-28 firmware
- cisco sg300-28mp firmware
- cisco sg300-28p firmware
- cisco sg300-28pp firmware
- cisco sg300-28sfp firmware
- cisco sg300-52 firmware
- cisco sg300-52mp firmware
- cisco sg300-52p firmware
- cisco sg500-28 firmware
- cisco sg500-28mpp firmware
- cisco sg500-28p firmware
- cisco sg500-52 firmware
- cisco sg500-52mp firmware
- cisco sg500-52p firmware
- cisco sg500x-24 firmware
- cisco sg500x-48 firmware
- cisco sg500x-48mp firmware
- cisco sg500x-48p firmware
- cisco sg500x24mpp firmware
- cisco sg500xg8f8t firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1891 is a high vulnerability (CVSS 7.5) in Cisco Small Business 300 Series Managed Switches, published July 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. No source names a fixed version.