PT-2016-1593 · Cisco · Cisco Nx-Os+1

Published 2016-02-23 · Updated 2016-12-06 · CVE-2016-1341

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions 7.0(1)N1(1) through 7.0(1)N1(3) and 7.0(4)N1(1)

Description The issue is related to a blank root password in the Cisco NX-OS, which allows local users to gain privileges. An unauthenticated, local attacker could log in to the system shell with root user privileges due to a missing password for the root user account. This account is created at installation and cannot be changed or deleted without impacting system functionality. An attacker could exploit this by physically connecting to the affected system, potentially accessing the system with root user privileges.

Recommendations For versions 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1), at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting physical access to the affected system to minimize the risk of exploitation.

Weakness Enumeration

CWE-264

CWE-255

Related Identifiers

BDU:2016-00894

CVE-2016-1341

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://osv.dev/vulnerability/CVE-2016-1341 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1341 · Security Note
• https://bdu.fstec.ru/vul/2016-00894 · Security Note
• http://securitytracker.com/id/1035088 · Note