PT-2017-17215 · Cisco · Cisco Nx-Os System+1

Published 2017-05-17 · Updated 2019-10-03 · CVE-2017-6650

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software versions 7.1 through 7.3

Description A vulnerability in the Telnet CLI command could allow an authenticated, local attacker to perform a command injection attack due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command, potentially allowing them to read or write arbitrary files at the user's privilege level outside of the user's path.

Recommendations For Cisco NX-OS System Software versions 7.1 through 7.3, consider disabling the Telnet CLI command until a patch is available to prevent command injection attacks. Restrict access to the Telnet CLI command to minimize the risk of exploitation. Avoid using crafted command arguments in the Telnet CLI command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

CVE-2017-6650

Affected Products

Cisco Nx-Os System

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6650 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6650 · Vendor Advisory
• http://securityfocus.com/bid/98528 · Vendor Advisory
• http://securitytracker.com/id/1038518 · Note