CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:N/A:C
EPSS
Percentile
5.1%
A vulnerability in the TACACS+ command authorization feature of Cisco NX-OS Software could allow an authenticated, local attacker to cause the system to reset.
The vulnerability is due to incorrect processing of very long command-line interface (CLI) commands by the TACACS+ command authorization feature. An attacker could exploit this vulnerability by being locally authenticated and executing a long CLI command that is subject to command authorization. An exploit could allow the attacker to cause the device to reload.
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit this vulnerability, an attacker must authenticate and have local access to a targeted system. These requirements would likely reduce the possibility of a successful exploit.
Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | nx_os | 6.0(2)u4 | cpe:2.3:o:cisco:nx_os:6.0\(2\)u4:*:*:*:*:*:*:* |
cisco | nx_os | 6.1(2)i2 | cpe:2.3:o:cisco:nx_os:6.1\(2\)i2:*:*:*:*:*:*:* |
cisco | nx_os | 6.2 | cpe:2.3:o:cisco:nx_os:6.2:*:*:*:*:*:*:* |
cisco | nx_os | 7.0(0)n1 | cpe:2.3:o:cisco:nx_os:7.0\(0\)n1:*:*:*:*:*:*:* |
cisco | nx_os | 6.0(2)u4(3) | cpe:2.3:o:cisco:nx_os:6.0\(2\)u4\(3\):*:*:*:*:*:*:* |
cisco | nx_os | 6.1(2)i2(3) | cpe:2.3:o:cisco:nx_os:6.1\(2\)i2\(3\):*:*:*:*:*:*:* |
cisco | nx_os | 6.2(8a) | cpe:2.3:o:cisco:nx_os:6.2\(8a\):*:*:*:*:*:*:* |
cisco | nx_os | 6.2(8b) | cpe:2.3:o:cisco:nx_os:6.2\(8b\):*:*:*:*:*:*:* |
cisco | nx_os | 6.2(10) | cpe:2.3:o:cisco:nx_os:6.2\(10\):*:*:*:*:*:*:* |
cisco | nx_os | 7.0(0)n1(1) | cpe:2.3:o:cisco:nx_os:7.0\(0\)n1\(1\):*:*:*:*:*:*:* |