Lucene search

[email protected]CVE-2019-1608

HistoryMar 08, 2019 - 8:29 p.m.

CVE-2019-1608

2019-03-0820:29:00

CWE-88

CWE-77

[email protected]

web.nvd.nist.gov

cisco

nx-os

cli

vulnerability

cve-2019-1608

security

mds 9000

nexus 7000

nexus 7700

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(27), 8.1(1b), and 8.3(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3).

Affected configurations

NVD

Node

cisconx-osRange8.2–8.3\(1\)

AND

ciscomds_9000Match-

Node

cisconx-osRange7.3–8.1\(1b\)

AND

ciscomds_9000Match-

Node

cisconx-osRange5.2–6.2\(27\)

AND

ciscomds_9000Match-

Node

cisconx-osRange8.0–8.2\(3\)

AND

cisconexus_7000Match-

cisconexus_7700Match-

Node

cisconx-osRange7.2–7.3\(3\)d1\(1\)

AND

cisconexus_7000Match-

cisconexus_7700Match-

Node

cisconx-osRange<6.2\(22\)

AND

cisconexus_7000Match-

cisconexus_7700Match-

CNA Affected

[
  {
    "product": "MDS 9000 Series Multilayer Switches",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.2(27)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.1(1b)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.3(1)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Nexus 7000 and 7700 Series Switches",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.2(22)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "7.3(3)D1(1)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.2(3)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107386

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1608

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-1608

nessus2 nvd1 prion1 cvelist1 cisco8