PT-2019-2215 · Cisco · Cisco Nexus 3000 Series+3

Published 2019-05-15 · Updated 2023-03-24 · CVE-2019-1810

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus 3000 Series and 9000 Series Switches (affected versions not specified)

Description A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. If the device has not been patched for the previously disclosed vulnerability, a successful exploit could allow the attacker to boot a malicious software image.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2019-01986

CVE-2019-1810

Affected Products

Cisco Nexus

Cisco Nexus 3000 Series

Cisco Nexus 9000 Series

Nx-Os

References · 6

• https://bdu.fstec.ru/vul/2019-01986 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1810 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv · Vendor Advisory
• http://securityfocus.com/bid/108431 · Note
• https://t.me/cvenotify/46777 · Telegram Post