CVE-2019-1892: Cisco ESW2-350g52dc Firmware

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause a memory corruption on an affected device. The vulnerability is due to improper validation of HTTPS packets. An attacker could exploit this vulnerability by sending a malformed HTTPS packet to the management web interface of the affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition.

Affected products

Cisco ESW2-350g52dc Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco ESW2-550x48dc Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF200-24 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF200-24p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF200-48 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF200-48p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-08 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-24 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-24mp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-24p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-24pp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-48 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-48p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF300-48pp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF302-08 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF302-08mp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF302-08mpp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF302-08p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF302-08pp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-24 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-24mp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-24p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-48 Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-48mp Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
Cisco SF500-48p Firmware: before 1.4.10.6 (fixed in 1.4.10.6)
and 32 more

Published 2019-07-06. Last modified 2026-06-17.