PT-2017-17214 · Cisco · Cisco Nx-Os+1

Published 2017-05-17 · Updated 2019-10-03 · CVE-2017-6649

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software versions 7.1 through 7.3

Description A vulnerability in the CLI could allow an authenticated, local attacker to perform a command injection attack due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command, potentially allowing them to read or write arbitrary files at the user's privilege level outside of the user's path.

Recommendations For versions 7.1 through 7.3, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable CLI commands to minimize the risk of exploitation. Avoid using crafted command arguments in CLI commands until the issue is resolved.

Fix

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

CVE-2017-6649

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://osv.dev/vulnerability/CVE-2017-6649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6649 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss · Vendor Advisory
• http://securityfocus.com/bid/98531 · Note
• http://securitytracker.com/id/1038518 · Note