PT-2019-2369 · Cisco · Cisco Nx-Os+2

Published 2019-05-15 · Updated 2023-04-20 · CVE-2019-1779

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software and Cisco NX-OS Software (affected versions not specified)

Description A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid device credentials to exploit this vulnerability.

Recommendations For Cisco FXOS Software and Cisco NX-OS Software, update to a version that includes the software updates released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but applying the software updates from Cisco is recommended.

Fix

Command Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-88

Related Identifiers

BDU:2019-02144

CVE-2019-1779

Affected Products

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1779 · Security Note
• https://bdu.fstec.ru/vul/2019-02144 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1779 · Vendor Advisory
• http://securityfocus.com/bid/108394 · Note