PT-2017-3328 · Cisco · Cisco Nx-Os System+4
Publicado
2017-11-29
·
Atualizado
2019-10-09
·
CVE-2017-12341
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco NX-OS System Software versions prior to the fixed version
Description
The issue is due to insufficient input validation during the installation of a software patch, allowing an authenticated, local attacker to perform a command injection attack. An attacker would need valid administrator credentials to exploit this. By installing a crafted patch image, an attacker could execute arbitrary commands on an affected system as root. This affects various Cisco products running Cisco NX-OS System Software, including Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, and others.
Recommendations
For Cisco NX-OS System Software, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.
Avoid installing crafted patch images until the issue is resolved.
There are no other workarounds that address this issue.
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Nx-Os System
Cisco Nexus
Multilayer Director Switches
Nexus 2000 Series Fabric Extenders
Nexus 5000 Series Switches