LiveActive security incident?Get immediate response
CVE Record

CVE-2019-16009: Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This Cisco device web interface flaw can let an attacker trick a logged-in administrator into unknowingly changing a router or switch. The attacker must convince the user to open a malicious link, but no attacker login is required. If the victim is an administrator, device configuration, command execution, or reload actions may be possible.

Executive priority

Treat as high priority for network infrastructure using Cisco web management. The business risk is unauthorized device change or disruption through administrator interaction, not confirmed automated exploitation. Prioritize externally reachable or broadly accessible management interfaces first.

Technical view

CVE-2019-16009 is a CSRF weakness in Cisco IOS and Cisco IOS XE Software web UI caused by insufficient CSRF protections. Exploitation requires user interaction and runs actions with the targeted user’s privilege level. CVSS v3.0 is 8.8 with high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is most relevant where affected Cisco IOS or IOS XE web UI management is enabled and reachable by users who administer devices. The bundle specifically lists Cisco IOS 12.2(15)B, but affected version evidence is incomplete here; confirm against Cisco’s advisory.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The attack is phishing-style CSRF: the attacker needs a web UI user to follow a malicious link while their session can authorize actions.

Researcher notes

Evidence supports CSRF in Cisco IOS and IOS XE web UI, CWE-352, CVSS 8.8. The source bundle does not include detailed fixed-release tables or workaround text, so validation should rely on Cisco’s advisory before declaring a device affected or remediated.

Mitigation direction

  • Review Cisco’s advisory for affected releases, fixed software, and official workarounds.
  • Upgrade affected Cisco IOS or IOS XE software according to Cisco guidance.
  • Limit web UI management access to trusted administrative networks.
  • Disable web UI management where it is not operationally required.
  • Warn administrators not to browse untrusted links during active management sessions.

Validation and detection

  • Inventory Cisco IOS and IOS XE devices with web UI management enabled.
  • Compare device software versions against Cisco’s advisory for CVE-2019-16009.
  • Confirm administrative web interfaces are not exposed to untrusted networks.
  • Review access logs for unexpected configuration, command, or reload activity.
  • Verify compensating controls restrict management access to authorized administrators.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-352: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-16009 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8.8High
CVSS 3.0 vector shape for CVE-2019-16009Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco IOS 12.2(15)Bn/aListed
Weakness

CWE details

CWE-352

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-352 · source CWE mapping

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs