PT-2021-2180 · Cisco · Cisco Nx-Os+1
Published
2021-02-24
·
Updated
2021-03-03
·
CVE-2021-1227
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco NX-OS Software (affected versions not specified)
Description
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note that the NX-API feature is disabled by default.
Recommendations
As a temporary workaround, consider disabling the NX-API feature until a patch is available.
Cisco has released software updates that address this vulnerability, it is recommended to apply these updates to resolve the issue.
There are no workarounds that address this vulnerability, updating the software is the only resolution.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Nx-Os
Cisco Nexus