PT-2019-2215 · Cisco · Cisco Nexus 3000 Series+3

CVE-2019-1810 · Publicado 2019-05-15 · Atualizado 2023-03-24

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus 3000 Series and 9000 Series Switches (affected versions not specified)

Description A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. If the device has not been patched for the previously disclosed vulnerability, a successful exploit could allow the attacker to boot a malicious software image.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

BDU:2019-01986

CVE-2019-1810

Produtos afetados

Cisco Nexus

Cisco Nexus 3000 Series

Cisco Nexus 9000 Series

Nx-Os

Referências · 6

• https://bdu.fstec.ru/vul/2019-01986 · Nota de Segurança
• http://securityfocus.com/bid/108431 · Nota
• https://osv.dev/vulnerability/CVE-2019-1810 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1810 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv · Aviso do Fabricante
• https://t.me/cvenotify/46777 · Publicação no Telegram