PT-2019-1572 · Cisco · Cisco Nx-Os+1

Published 2019-03-06 · Updated 2020-10-08 · CVE-2019-1591

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series ACI Mode Switch Software versions prior to 14.0(3d)

Description The issue is related to insufficient sanitization of user-supplied input when issuing a specific CLI command with parameters on an affected device. This could allow an authenticated, local attacker to escape a restricted shell and execute arbitrary commands with root-level privileges. The vulnerability is due to weaknesses in access restrictions to certain features in the Cisco NX-OS network operating system.

Recommendations For versions prior to 14.0(3d), update to a version 14.0(3d) or later to resolve the issue. As a temporary workaround, consider restricting access to the affected CLI commands until a patch is available. Avoid using parameters that could lead to exploitation of the vulnerability in the affected CLI commands.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

CWE-264

Related Identifiers

BDU:2019-01103

CVE-2019-1591

Affected Products

Cisco Nx-Os

Cisco Nexus 9000 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1591 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-aci-shell-escape · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01103 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1591 · Vendor Advisory
• http://securityfocus.com/bid/107311 · Note