PT-2019-2454 · Cisco · Cisco Nx-Os+2

Published 2019-05-15 · Updated 2020-10-16 · CVE-2019-1781

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software versions prior to the fixed version Cisco NX-OS Software versions prior to the fixed version

Description The issue is related to insufficient validation of arguments passed to certain CLI commands, which could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this issue. The attacker could exploit this by including malicious input as the argument of an affected command.

Recommendations For Cisco FXOS Software, update to a version that includes the fix for this issue. For Cisco NX-OS Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI commands that are vulnerable to this issue until a patch is available. Avoid using malicious input as arguments for CLI commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

RCE

Argument Injection

Weakness Enumeration

CWE-77

CWE-20

CWE-88

Related Identifiers

BDU:2019-02232

CVE-2019-1781

Affected Products

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02232 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1781 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1781 · Vendor Advisory
• http://securityfocus.com/bid/108407 · Note