{"cve":"CVE-2019-1859","nvd":{"published":"2019-05-03T17:29:01.500","modified":"2026-06-17T02:29:28.290","status":"Modified","description":"A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. An attacker could exploit this vulnerability by attempting to connect to the device via SSH. A successful exploit could allow the attacker to access the configuration as an administrative user if the default credentials are not changed. There are no workarounds available; however, if client-side certificate authentication is enabled, disable it and use strong password authentication. Client-side certificate authentication is disabled by default.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-295","CWE-285"],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv"],"products":["cisco:sf200-24_firmware","cisco:sf200-24fp_firmware","cisco:sf200-24p_firmware","cisco:sf200-48_firmware","cisco:sf200-48p_firmware","cisco:sf250-24_firmware","cisco:sf250-24p_firmware","cisco:sf250-48_firmware","cisco:sf250-48hp_firmware","cisco:sf300-08_firmware","cisco:sf300-24_firmware","cisco:sf300-24mp_firmware","cisco:sf300-24p_firmware","cisco:sf300-24pp_firmware","cisco:sf300-48_firmware","cisco:sf300-48p_firmware","cisco:sf300-48pp_firmware","cisco:sf302-08_firmware","cisco:sf302-08mp_firmware","cisco:sf302-08mpp_firmware","cisco:sf302-08p_firmware","cisco:sf302-08pp_firmware","cisco:sf350-48_firmware","cisco:sf350-48mp_firmware","cisco:sf350-48p_firmware","cisco:sf500-24_firmware","cisco:sf500-24p_firmware","cisco:sf500-48_firmware","cisco:sf500-48p_firmware","cisco:sf550x-24_firmware","cisco:sf550x-24mp_firmware","cisco:sf550x-24p_firmware","cisco:sf550x-48_firmware","cisco:sf550x-48mp_firmware","cisco:sf550x-48p_firmware","cisco:sg200-08_firmware","cisco:sg200-08p_firmware","cisco:sg200-10fp_firmware","cisco:sg200-18_firmware","cisco:sg200-26_firmware","cisco:sg200-26fp_firmware","cisco:sg200-26p_firmware","cisco:sg200-50_firmware","cisco:sg200-50fp_firmware","cisco:sg200-50p_firmware","cisco:sg250-08_firmware","cisco:sg250-08hp_firmware","cisco:sg250-10p_firmware","cisco:sg250-18_firmware","cisco:sg250-26_firmware"],"source":"nvd","synced_at":"2026-10-19T20:56:19.218283075+00:00"},"epss":{"cve":"CVE-2019-1859","score":0.00839,"percentile":0.57839,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}