CVE-2019-1849: Cisco IOS XR

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices, a crash could lead to system instability and the inability to process or forward traffic through the device, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.

Affected products

• Cisco IOS XR: from 6.1.0, before 6.3.3 (fixed in 6.3.3); from 6.4.0, before 6.4.2 (fixed in 6.4.2); from 6.5.0, before 6.5.2 (fixed in 6.5.2); from 6.6.0, before 6.6.1 (fixed in 6.6.1)

Published 2019-05-16. Last modified 2026-06-17.