PT-2019-2367 · Cisco · Cisco Nx-Os+1

Published 2019-05-15 · Updated 2020-10-16 · CVE-2019-1727

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description The issue is related to insufficient sanitization of user-supplied parameters passed to certain Python functions in the scripting sandbox, allowing an authenticated, local attacker to escape the Python parser and execute arbitrary commands to elevate their privilege level. The attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges.

Recommendations To resolve the issue, update to a version of Cisco NX-OS Software that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the Python scripting subsystem to minimize the risk of exploitation. Restrict access to the scripting sandbox to limit the possibility of a successful exploit. Avoid using the vulnerable Python functions in the scripting sandbox until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

CWE-264

Related Identifiers

BDU:2019-02142

CVE-2019-1727

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-pyth-escal · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1727 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1727 · Vendor Advisory
• http://securityfocus.com/bid/108341 · Note