PT-2019-1564 · Cisco · Tetration Analytics+2

Published 2019-03-06 · Updated 2020-10-05 · CVE-2019-1618

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Switches in standalone NX-OS mode versions prior to 7.0(3)I7(5)

Description A vulnerability in the Tetration Analytics agent could allow an authenticated, local attacker to execute arbitrary code as root due to an incorrect permissions setting. An attacker could exploit this vulnerability by replacing valid agent files with malicious code, resulting in the execution of code supplied by the attacker.

Recommendations For versions prior to 7.0(3)I7(5), update to version 7.0(3)I7(5) or later to resolve the issue. As a temporary workaround, consider restricting access to the Tetration Analytics agent to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-275

Related Identifiers

BDU:2019-01095

CVE-2019-1618

Affected Products

Cisco Nexus

Cisco Nexus 9000 Series Switches

Tetration Analytics

References · 5

• https://osv.dev/vulnerability/CVE-2019-1618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1618 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-tetra-ace · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01095 · Security Note
• http://securityfocus.com/bid/107322 · Note