PT-2019-3335 · Cisco+1 · Cisco Ios Xe+3

Published 2019-09-25 · Updated 2019-10-09 · CVE-2019-12717

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified) Cisco IOS XE (affected versions not specified)

Description The issue exists due to insufficient validation of arguments passed to a specific command related to the virtualization manager (VMAN) in the affected software. This could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. A successful exploit may lead to complete system compromise. The attacker would need valid administrator credentials to exploit this vulnerability.

Recommendations For Cisco NX-OS Software, update to a version that includes the fix for this issue. For Cisco IOS XE, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the VMAN CLI command to minimize the risk of exploitation. Restrict access to the underlying Linux operating system to prevent arbitrary command execution with root privileges.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-03442

CVE-2019-12717

Affected Products

Cisco Ios Xe

Cisco Nx-Os

Cisco Nexus

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12717 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12717 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03442 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-nxos-vman-cmd-inj · Vendor Advisory