PT-2018-8733 · Cisco · Cisco Nx-Os+1

Published 2018-06-20 · Updated 2019-10-09 · CVE-2018-0293

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software (affected versions not specified)

Description: A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is due to incorrect RBAC privilege assignment for certain CLI commands. An attacker could exploit this vulnerability by authenticating to a device as a nonadministrative user and executing specific commands from the CLI. An exploit could allow the attacker to run commands that should be restricted to administrative users. These commands could modify the configuration or boot image on the device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

CWE-264

Related Identifiers

CVE-2018-0293

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0293 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosrbac · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0293 · Vendor Advisory
• http://securityfocus.com/bid/104520 · Note
• http://securitytracker.com/id/1041169 · Note