topic CVE not found - OpenSSH vulnerabilitiy in Network Security

CVE not found - OpenSSH vulnerabilitiy

moorec43 — Thu, 27 Jan 2022 14:23:02 GMT

I have recently had some openSSH vulnerabilities show up on a report for some of my switches and routers and when I searched the CVE on Cisco's advisory page nothing came up.

Is it safe to assume that this vulnerability does not affect my Cisco products? This CVE just showed up, CVE-2019-16905, and I want to make sure that it doesn't affect the device before saying it is a false positive. Any help would be appreciated.

Thanks

Re: CVE not found - OpenSSH vulnerabilitiy

balaji.bandi — Thu, 27 Jan 2022 14:39:15 GMT

May be condition as below :

After analysis, Cisco has decided against performing additional actions on this product due to one of the following reasons:

- The product is no longer maintained, having reached End of Software Maintenance.

- The product is still being maintained, but a business decision was made not to upgrade the vulnerable product.

- The product uses the affected third-party component in such a way as to not be affected by these vulnerabilities.

Conditions: Device with default configuration.

Re: CVE not found - OpenSSH vulnerabilitiy

Leo Laohoo — Fri, 28 Jan 2022 00:04:22 GMT

@moorec43 wrote:

I have recently had some openSSH vulnerabilities show up on a report for some of my switches and routers and when I searched the CVE on Cisco's advisory page nothing came up.

ConfD CLI Secure Shell Server Privilege Escalation Vulnerability