CVE-2019-15993

Cisco Small Business Switches Information Disclosure Vulnerability

7.5 HighPublic exploit

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

10.3%Up 9.7 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

Cisco Small Business Switches Information Disclosure Vulnerability

Record: CVE-2019-15993
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-16
Updated: 2026-11-02

EUVDEUVD-2019-6886 7.5

Record: EUVD-2019-6886
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-72qf-gj46-vcj3 5.3

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated,...

Record: GHSA-72qf-gj46-vcj3
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-287
Updated: 2026-11-02

NVD 5.3

Record: CVE-2019-15993
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-16, CWE-287
Updated: 2026-11-02

Affected products

Show 103 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure	2023-04-05

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-15993 is a high vulnerability (CVSS 7.5) in Cisco Small Business 250 Series Smart Switches Software, published September 23, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.3%, the 95th percentile. No source names a fixed version.