PT-2019-3387 · Cisco · Cisco Fx-Os+1

CVE-2019-12699 · Published 2019-10-02 · Updated 2023-04-20

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco FX-OS versions (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software versions (affected versions not specified)

Description The issue exists due to insufficient input validation in the command-line interface of the affected software, allowing an authenticated, local attacker to execute commands on the underlying operating system with root privileges. An attacker could exploit this by including crafted arguments to specific CLI commands, potentially leading to the execution of arbitrary commands with elevated privileges.

Recommendations For Cisco FX-OS, update to a version that includes the fix for this issue. For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation. Avoid using crafted arguments in CLI commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-03528

CVE-2019-12699

Affected Products

Cisco Fx-Os

Cisco Ftd

References · 5

• https://bdu.fstec.ru/vul/2019-03528 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12699 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fxos-cmd-inject · Vendor Advisory
• https://t.me/cvenotify/48718 · Telegram Post