PT-2019-1578 · Cisco · Cisco Nx-Os+1

Published 2019-03-06 · Updated 2019-10-09 · CVE-2019-1615

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions prior to 7.0(3)I7(5) Cisco NX-OS versions prior to 13.2(1l) Cisco NX-OS versions prior to 7.0(3)F3(5)

Description The issue is related to improper verification of digital signatures for software images, which could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. An attacker could exploit this by loading an unsigned software image. A successful exploit could allow the attacker to boot a malicious software image.

Recommendations For Nexus 3000 Series Switches running software versions prior to 7.0(3)I7(5), update to version 7.0(3)I7(5) or later, which includes a BIOS upgrade as part of the software upgrade. For Nexus 9000 Series Fabric Switches in ACI Mode running software versions prior to 13.2(1l), update to version 13.2(1l) or later. For Nexus 9000 Series Switches in Standalone NX-OS Mode running software versions prior to 7.0(3)I7(5), update to version 7.0(3)I7(5) or later. For Nexus 9500 R-Series Line Cards and Fabric Modules running software versions prior to 7.0(3)F3(5), update to version 7.0(3)F3(5) or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2019-01109

CVE-2019-1615

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1615 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1615 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-sig-verif · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01109 · Security Note
• http://securityfocus.com/bid/107397 · Note