Security readout for executives and security teams
Plain-English summary
This issue affects Cisco IOS XE on Cisco 4000 Series ISRs using ISDN Dialer interfaces. In a narrow timing window before PPP authentication fails, unauthenticated IPv4 traffic may pass through an ISDN link. Business impact is limited but real: unintended network traffic could briefly traverse a router connection expected to require authentication.
Executive priority
Treat as a targeted network hygiene issue, not an emergency. Prioritize organizations still using ISDN backup or legacy router links, especially where Cisco 4000 ISRs remain in production with Dialer/BRI configurations.
Technical view
Cisco describes insufficient validation of PPP IPCP state on ISDN Dialer connections. An adjacent caller, or a remote traffic source routed toward a misconfigured ISDN exit path, could pass IPv4 traffic before PPP authentication fails. Impact is integrity-only per CVSS, with no confidentiality or availability impact stated.
Likely exposure
Exposure appears limited to Cisco 4000 Series ISRs running Cisco IOS XE with ISDN Dialer/BRI configurations. The remote scenario also requires both Dialer and BRI configured and a CHAP password mismatch with the remote end.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Exploitation requires ISDN-specific routing or adjacency conditions and only permits unauthenticated IPv4 traffic for a few seconds during call setup before PPP failure.
Researcher notes
The key validation point is configuration-dependent exposure, not simply IOS XE presence. The provided data does not include fixed version details, proof-of-concept status, or exploit observations, so remediation should follow Cisco's advisory and local router configuration review.
Mitigation direction
- Review Cisco's advisory for affected and fixed IOS XE releases.
- Inventory Cisco 4000 Series ISRs with ISDN Dialer or BRI interfaces.
- Correct CHAP password mismatches on PPP ISDN links.
- Disable or remove unused ISDN Dialer/BRI configurations.
- Prioritize upgrade or configuration changes where ISDN remains reachable.
Validation and detection
- Confirm whether any Cisco 4000 ISR runs IOS XE with ISDN enabled.
- Check router configurations for Dialer interfaces, BRI interfaces, and PPP CHAP settings.
- Compare installed IOS XE versions against Cisco advisory guidance.
- Review logs for unexpected ISDN call setup or PPP authentication failures.
- Document any ISDN links that can carry routed IPv4 traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-12664 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.7MediumVector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 20190925 Cisco IOS XE Software ISDN Data Leak VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.