PT-2017-17214 · Cisco · Cisco Nx-Os+1

Publicado 2017-05-17 · Atualizado 2019-10-03 · CVE-2017-6649

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software versions 7.1 through 7.3

Description A vulnerability in the CLI could allow an authenticated, local attacker to perform a command injection attack due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command, potentially allowing them to read or write arbitrary files at the user's privilege level outside of the user's path.

Recommendations For versions 7.1 through 7.3, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable CLI commands to minimize the risk of exploitation. Avoid using crafted command arguments in CLI commands until the issue is resolved.

Correção

Command Injection

RCE

Enumeração de Fraquezas

CWE-77

CWE-20

Identificadores relacionados

CVE-2017-6649

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 5

• http://securityfocus.com/bid/98531 · Nota
• https://osv.dev/vulnerability/CVE-2017-6649 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6649 · Nota de Segurança
• http://securitytracker.com/id/1038518 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss · Aviso do Fabricante