PT-2019-2293 · Cisco · Cisco Nx-Os+2

Published 2019-05-15 · Updated 2023-04-20 · CVE-2019-1734

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software (affected versions not specified) Cisco NX-OS Software (affected versions not specified)

Description The issue is related to incomplete role-based access control (RBAC) verification in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software. This could allow an authenticated, local attacker to view sensitive system files that should be restricted, potentially leading to additional reconnaissance attacks. The attacker needs valid device credentials to exploit this vulnerability. The vulnerability can be exploited by issuing a specific CLI diagnostic command with crafted user-input parameters.

Recommendations For Cisco FXOS Software, update to a version that includes the fix for this issue. For Cisco NX-OS Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI diagnostic command until a patch is available. Avoid using crafted user-input parameters in the affected CLI diagnostic command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-02064

CVE-2019-1734

Affected Products

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

References · 5

• https://osv.dev/vulnerability/CVE-2019-1734 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02064 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-info · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1734 · Security Note
• https://securityfocus.com/bid/108381 · Note