PT-2021-2180 · Cisco · Cisco Nx-Os+1

Published

2021-02-24

·

Updated

2021-03-03

·

CVE-2021-1227

CVSS v2.0

9.4

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)
Description A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note that the NX-API feature is disabled by default.
Recommendations As a temporary workaround, consider disabling the NX-API feature until a patch is available. Cisco has released software updates that address this vulnerability, it is recommended to apply these updates to resolve the issue. There are no workarounds that address this vulnerability, updating the software is the only resolution.

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2021-01087
CVE-2021-1227

Affected Products

Cisco Nx-Os
Cisco Nexus