A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of arguments for a specific CLI command. An attacker could exploit this vulnerability by including crafted input as the argument of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-Lq6jsZhH [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-Lq6jsZhH”]
This advisory is part of the August 2024 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: August 2024 Semiannual Cisco FXOS and NX-OS Software Security Advisory Bundled Publication [“https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75417”].
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | cisco_nx-os_software | 9.3 | cpe:2.3:a:cisco:cisco_nx-os_software:9.3:*:*:*:*:*:*:* |
cisco | cisco_nx-os_software | 10.1 | cpe:2.3:a:cisco:cisco_nx-os_software:10.1:*:*:*:*:*:*:* |
cisco | cisco_nx-os_software | 10.2 | cpe:2.3:a:cisco:cisco_nx-os_software:10.2:*:*:*:*:*:*:* |
cisco | cisco_nx-os_software | 10.3 | cpe:2.3:a:cisco:cisco_nx-os_software:10.3:*:*:*:*:*:*:* |
cisco | cisco_nx-os_software | 10.4 | cpe:2.3:a:cisco:cisco_nx-os_software:10.4:*:*:*:*:*:*:* |
cisco | nexus_3000 | any | cpe:2.3:h:cisco:nexus_3000:any:*:*:*:*:*:*:* |
cisco | nexus_9000 | any | cpe:2.3:h:cisco:nexus_9000:any:*:*:*:*:*:*:* |
cisco | unified_computing_system | any | cpe:2.3:h:cisco:unified_computing_system:any:*:*:*:*:*:*:* |
cisco | nx_os | 16.0 | cpe:2.3:o:cisco:nx_os:16.0:*:*:*:*:*:*:* |
cisco | cisco_nx-os_software | 9.3(3) | cpe:2.3:a:cisco:cisco_nx-os_software:9.3\(3\):*:*:*:*:*:*:* |