PT-2019-2451 · Cisco+1 · Cisco Nx-Os+2

Published 2019-05-15 · Updated 2020-10-16 · CVE-2019-1783

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description The issue is related to insufficient validation of arguments passed to a specific CLI command, allowing an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. An attacker could exploit this by including malicious input as the argument of an affected command, potentially executing arbitrary commands with elevated privileges. The attacker would need valid administrator credentials to exploit this.

Recommendations For Cisco NX-OS Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

Command Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-88

Related Identifiers

BDU:2019-02229

CVE-2019-1783

Affected Products

Cisco Nx-Os

Cisco Nexus

Linux

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1783 · Security Note
• https://bdu.fstec.ru/vul/2019-02229 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1783 · Vendor Advisory
• http://securityfocus.com/bid/108370 · Note