PT-2018-8600 · Cisco · Cisco Nx-Os System+1

Published 2018-01-17 · Updated 2019-10-09 · CVE-2018-0090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS System Software versions 7.3.2 and earlier

Description: A vulnerability in the management interface access control list (ACL) configuration could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface, potentially impacting the CPU of the targeted device and resulting in a DoS condition.

Recommendations: For Cisco NX-OS System Software version 7.3.2 and earlier, consider disabling the management interface or restricting access to it until a patch is available. As a temporary workaround, restrict traffic to the management interface to minimize the risk of exploitation. There are no workarounds that address this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2018-0090

Affected Products

Cisco Nx-Os System

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0090 · Security Note
• http://securityfocus.com/bid/102753 · Note
• http://securitytracker.com/id/1040247 · Note