Lucene search

CiscoCVE-2018-0301

HistoryJun 20, 2018 - 9:29 p.m.

CVE-2018-0301

2018-06-2021:29:00

CWE-119

CWE-20

cisco

web.nvd.nist.gov

vulnerability

cisco

nx-os

nx-api

remote attacker

buffer overflow

cve-2018-0301

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.012

Percentile

85.3%

JSON

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on an affected system, causing a buffer overflow. The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root. Note: NX-API is disabled by default. This vulnerability affects: MDS 9000 Series Multilayer Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd45804, CSCve02322, CSCve02412.

Affected configurations

Nvd

Node

cisconx-osRange6.0–7.3\(3\)n1\(1\)

AND

cisconexus_5000Match-

cisconexus_5010Match-

cisconexus_5020Match-

cisconexus_5548pMatch-

cisconexus_5548upMatch-

cisconexus_5596tMatch-

cisconexus_5596upMatch-

cisconexus_56128pMatch-

cisconexus_5624qMatch-

cisconexus_5648qMatch-

cisconexus_5672upMatch-

cisconexus_5696qMatch-

Node

cisconx-osRange7.2–7.3\(2\)d1\(1\)

cisconx-osRange8.0–8.1\(1\)

cisconx-osMatch8.1

cisconx-osMatch8.2

AND

cisconexus_7000Match-

cisconexus_7700Match-

Node

cisconx-osRange<7.0\(3\)i4

cisconx-osRange7.0\(3\)i5–7.0\(3\)i7\(1\)

cisconx-osMatch7.0\(3\)i7

AND

cisconexus_92160yc-xMatch-

cisconexus_92304qcMatch-

cisconexus_9236cMatch-

cisconexus_9272qMatch-

cisconexus_93108tc-exMatch-

cisconexus_93120txMatch-

cisconexus_93128txMatch-

cisconexus_93180yc-exMatch-

cisconexus_9332pqMatch-

cisconexus_9372pxMatch-

cisconexus_9372txMatch-

cisconexus_9396pxMatch-

cisconexus_9396txMatch-

cisconexus_9504Match-

cisconexus_9508Match-

cisconexus_9516Match-

cisconexus_n9k-c9508-fm-rMatch-

cisconexus_n9k-x9636c-rMatch-

cisconexus_n9k-x9636q-rMatch-

Node

cisconx-osRange<7.0\(3\)i4

cisconx-osRange7.0\(3\)i5–7.0\(3\)i7\(1\)

cisconx-osMatch7.0\(3\)i7

AND

cisconexus_172tq-xlMatch-

cisconexus_3016Match-

cisconexus_3048Match-

cisconexus_3064-32tMatch-

cisconexus_3064-tMatch-

cisconexus_3064-xMatch-

cisconexus_3100-vMatch-

cisconexus_31128pqMatch-

cisconexus_3132c-zMatch-

cisconexus_3132qMatch-

cisconexus_3132q-xMatch-

cisconexus_3132q-xlMatch-

cisconexus_3164qMatch-

cisconexus_3172pqMatch-

cisconexus_3172pq-xlMatch-

cisconexus_3172tqMatch-

cisconexus_3172tq-32tMatch-

cisconexus_3232cMatch-

cisconexus_3264c-eMatch-

cisconexus_3264qMatch-

cisconexus_34180ycMatch-

cisconexus_3524-xMatch-

cisconexus_3524-xlMatch-

cisconexus_3548Match-

cisconexus_3548-xMatch-

cisconexus_3548-xlMatch-

cisconexus_3636c-rMatch-

cisconexus_c36180yc-rMatch-

Node

cisconx-osRange7.3–7.3\(3\)n1\(1\)

cisconx-osMatch6.0

cisconx-osMatch7.0

cisconx-osMatch7.1

cisconx-osMatch7.2

AND

cisconexus_6001pMatch-

cisconexus_6001tMatch-

Node

cisconx-osMatch7.0

AND

cisconexus_9500Match-

Node

cisconx-osRange7.3–8.1\(1\)

cisconx-osMatch5.2

cisconx-osMatch6.2

cisconx-osMatch8.1

cisconx-osMatch8.2

AND

ciscomds_9000Match-

VendorProductVersionCPE
cisconx-os*cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
cisconexus_5000-cpe:2.3:h:cisco:nexus_5000:-:*:*:*:*:*:*:*
cisconexus_5010-cpe:2.3:h:cisco:nexus_5010:-:*:*:*:*:*:*:*
cisconexus_5020-cpe:2.3:h:cisco:nexus_5020:-:*:*:*:*:*:*:*
cisconexus_5548p-cpe:2.3:h:cisco:nexus_5548p:-:*:*:*:*:*:*:*
cisconexus_5548up-cpe:2.3:h:cisco:nexus_5548up:-:*:*:*:*:*:*:*
cisconexus_5596t-cpe:2.3:h:cisco:nexus_5596t:-:*:*:*:*:*:*:*
cisconexus_5596up-cpe:2.3:h:cisco:nexus_5596up:-:*:*:*:*:*:*:*
cisconexus_56128p-cpe:2.3:h:cisco:nexus_56128p:-:*:*:*:*:*:*:*
cisconexus_5624q-cpe:2.3:h:cisco:nexus_5624q:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	nx-os	*	cpe:2.3:o:cisco:nx-os::::::::
cisco	nexus_5000	-	cpe:2.3:h:cisco:nexus_5000:-:::::::*
cisco	nexus_5010	-	cpe:2.3:h:cisco:nexus_5010:-:::::::*
cisco	nexus_5020	-	cpe:2.3:h:cisco:nexus_5020:-:::::::*
cisco	nexus_5548p	-	cpe:2.3:h:cisco:nexus_5548p:-:::::::*
cisco	nexus_5548up	-	cpe:2.3:h:cisco:nexus_5548up:-:::::::*
cisco	nexus_5596t	-	cpe:2.3:h:cisco:nexus_5596t:-:::::::*
cisco	nexus_5596up	-	cpe:2.3:h:cisco:nexus_5596up:-:::::::*
cisco	nexus_56128p	-	cpe:2.3:h:cisco:nexus_56128p:-:::::::*
cisco	nexus_5624q	-	cpe:2.3:h:cisco:nexus_5624q:-:::::::*

Rows per page:

1-10 of 751

CNA Affected

[
  {
    "product": "Cisco NX-OS unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco NX-OS unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104512

www.securitytracker.com/id/1041169

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-bo

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.012

Percentile

85.3%

JSON

Related for CVE-2018-0301