Lucene search

[email protected]CVE-2018-0294

HistoryJun 20, 2018 - 9:29 p.m.

CVE-2018-0294

2018-06-2021:29:00

CWE-264

[email protected]

web.nvd.nist.gov

cisco

fxos

nx-os

vulnerability

unauthorized account

administrator

authentication

ssh

firepower

nexus

ucs

nvd

cve-2018-0294

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete sensitive files when certain CLI commands are used to clear the device configuration and reload a device. An attacker could exploit this vulnerability by logging into an affected device as an administrative user and configuring an unauthorized account for the device. The account would not require a password for authentication and would be accessible only via a Secure Shell (SSH) connection to the device. A successful exploit could allow the attacker to configure an unauthorized account that has administrative privileges, does not require a password for authentication, and does not appear in the running configuration or the audit logs for the affected device. This vulnerability affects Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Fabric Extenders, Nexus 3500 Platform Switches, Nexus 4000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd13993, CSCvd34845, CSCvd34857, CSCvd34862, CSCvd34879, CSCve35753.

Affected configurations

NVD

Node

cisconx-osMatch7.3\(2\)n1\(0.354\)

AND

cisconexus_5000Match-

cisconexus_5010Match-

cisconexus_5020Match-

cisconexus_5548pMatch-

cisconexus_5548upMatch-

cisconexus_5596tMatch-

cisconexus_5596upMatch-

cisconexus_56128pMatch-

cisconexus_5624qMatch-

cisconexus_5648qMatch-

cisconexus_5672upMatch-

cisconexus_5696qMatch-

Node

cisconx-osMatch5.2\(1\)sv3\(1.10\)

AND

cisconexus_1000vMatch-vmware_vsphere

Node

cisconx-osMatch8.8\(3.5\)s0

AND

cisconexus_92160yc-xMatch-

cisconexus_92304qcMatch-

cisconexus_9236cMatch-

cisconexus_9272qMatch-

cisconexus_93108tc-exMatch-

cisconexus_93120txMatch-

cisconexus_93128txMatch-

cisconexus_93180yc-exMatch-

cisconexus_9332pqMatch-

cisconexus_9372pxMatch-

cisconexus_9372txMatch-

cisconexus_9396pxMatch-

cisconexus_9396txMatch-

cisconexus_9504Match-

cisconexus_9508Match-

cisconexus_9516Match-

cisconexus_n9k-c9508-fm-rMatch-

cisconexus_n9k-x9636c-rMatch-

cisconexus_n9k-x9636q-rMatch-

Node

cisconx-osMatch7.0\(3\)i2\(4a\)

AND

cisconexus_172tq-xlMatch-

cisconexus_3016Match-

cisconexus_3048Match-

cisconexus_3064-32tMatch-

cisconexus_3064-tMatch-

cisconexus_3064-xMatch-

cisconexus_3100-vMatch-

cisconexus_31128pqMatch-

cisconexus_3132c-zMatch-

cisconexus_3132qMatch-

cisconexus_3132q-xMatch-

cisconexus_3132q-xlMatch-

cisconexus_3164qMatch-

cisconexus_3172pqMatch-

cisconexus_3172pq-xlMatch-

cisconexus_3172tqMatch-

cisconexus_3172tq-32tMatch-

cisconexus_3232cMatch-

cisconexus_3264c-eMatch-

cisconexus_3264qMatch-

cisconexus_34180ycMatch-

cisconexus_3524-xMatch-

cisconexus_3524-xlMatch-

cisconexus_3548Match-

cisconexus_3548-xMatch-

cisconexus_3548-xlMatch-

cisconexus_3636c-rMatch-

cisconexus_c36180yc-rMatch-

Node

cisconx-osMatch7.0\(3\)i2\(4a\)

AND

ciscoucs_6120xpMatch-

ciscoucs_6140xpMatch-

ciscoucs_6248upMatch-

ciscoucs_6296upMatch-

ciscoucs_6324Match-

ciscoucs_6332Match-

Node

ciscofirepower_extensible_operating_systemRange2.1.1–2.1.1.86

ciscofirepower_extensible_operating_systemRange2.2–2.2.2.17

ciscofxosRange1.1–2.0.1.159

AND

ciscofirepower_4110Match-

ciscofirepower_4120Match-

ciscofirepower_4140Match-

ciscofirepower_4150Match-

Node

ciscofirepower_extensible_operating_systemRange2.1.1–2.1.1.86

ciscofirepower_extensible_operating_systemRange2.2–2.2.2.17

ciscofxosRange1.1–2.0.1.159

AND

ciscofirepower_9300_security_applianceMatch-

Node

cisconx-osMatch4.1\(2\)e1\(1a\)

AND

cisconexus_4001Match-

CPENameOperatorVersion
cisco:nx-oscisco nx-oseq7.3\(2\)n1\(0.354\)

CPE	Name	Operator	Version
cisco:nx-os	cisco nx-os	eq	7.3\(2\)n1\(0.354\)

CNA Affected

[
  {
    "product": "Cisco FXOS and NX-OS unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco FXOS and NX-OS unknown"
      }
    ]
  }
]

References

www.securitytracker.com/id/1041169

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosadmin

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2018-0294

nessus3 prion1 cvelist1 nvd1 cisco1