PT-2019-2293 · Cisco · Cisco Nx-Os+2

Publicado 2019-05-15 · Atualizado 2023-04-20 · CVE-2019-1734

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software (affected versions not specified) Cisco NX-OS Software (affected versions not specified)

Description The issue is related to incomplete role-based access control (RBAC) verification in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software. This could allow an authenticated, local attacker to view sensitive system files that should be restricted, potentially leading to additional reconnaissance attacks. The attacker needs valid device credentials to exploit this vulnerability. The vulnerability can be exploited by issuing a specific CLI diagnostic command with crafted user-input parameters.

Recommendations For Cisco FXOS Software, update to a version that includes the fix for this issue. For Cisco NX-OS Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI diagnostic command until a patch is available. Avoid using crafted user-input parameters in the affected CLI diagnostic command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2019-02064

CVE-2019-1734

Produtos afetados

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-1734 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02064 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-info · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1734 · Nota de Segurança
• https://securityfocus.com/bid/108381 · Nota