CVE-2019-12655: Cisco IOS XE Software FTP Application Layer Gateway for NAT, NAT64, and ZBFW Denial of Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-25 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT IPv6 to IPv4 (NAT64), and the Zone-Based Policy Firewall (ZBFW) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a buffer overflow that occurs when an affected device inspects certain FTP traffic. An attacker could exploit this vulnerability by performing a specific FTP transfer through the device. A successful exploit could allow the attacker to cause the device to reload.

Affected products

Cisco IOS: from 3.16.8s before 16.3.8; from 16.10.1 before 16.11.1; 16.6.4, 16.6.5, 16.9.1, 16.9.2 — fixed in 16.11.1, 16.3.8

How to fix

Upgrade to a fixed version: Cisco IOS 16.11.1, 16.3.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12655 or the next vulnerability affects your stack