PT-2018-8733 · Cisco · Cisco Nx-Os+1

Publicado 2018-06-20 · Atualizado 2019-10-09 · CVE-2018-0293

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software (affected versions not specified)

Description: A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is due to incorrect RBAC privilege assignment for certain CLI commands. An attacker could exploit this vulnerability by authenticating to a device as a nonadministrative user and executing specific commands from the CLI. An exploit could allow the attacker to run commands that should be restricted to administrative users. These commands could modify the configuration or boot image on the device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

CWE-264

Identificadores relacionados

CVE-2018-0293

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 5

• http://securityfocus.com/bid/104520 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0293 · Nota de Segurança
• http://securitytracker.com/id/1041169 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosrbac · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0293 · Aviso do Fabricante