PT-2019-3387 · Cisco · Cisco Fx-Os+1
CVE-2019-12699
·
Publicado
2019-10-02
·
Atualizado
2023-04-20
CVSS v3.1
8.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco FX-OS versions (affected versions not specified)
Cisco Firepower Threat Defense (FTD) Software versions (affected versions not specified)
Description
The issue exists due to insufficient input validation in the command-line interface of the affected software, allowing an authenticated, local attacker to execute commands on the underlying operating system with root privileges. An attacker could exploit this by including crafted arguments to specific CLI commands, potentially leading to the execution of arbitrary commands with elevated privileges.
Recommendations
For Cisco FX-OS, update to a version that includes the fix for this issue.
For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.
Avoid using crafted arguments in CLI commands until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
OS Command Injection
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Fx-Os
Cisco Ftd