PT-2019-2219 · Cisco · Cisco Nx-Os+1

Published 2019-05-15 · Updated 2020-10-09 · CVE-2019-1729

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description A vulnerability in the CLI implementation of a specific command used for image maintenance could allow an authenticated, local attacker to overwrite any file on the file system, including system files, at the root privilege level. This occurs due to the lack of verification of user-input parameters and digital-signature verification for image files when using a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device and issuing a command at the CLI, potentially leading to a denial of service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-20

CWE-347

Related Identifiers

BDU:2019-01990

CVE-2019-1729

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-file-write · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1729 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01990 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1729 · Security Note
• http://securityfocus.com/bid/108378 · Note