CVE-2019-1606: Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1606)
First published: Fri Mar 08 2019(Updated: )
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid user credentials to exploit this vulnerability. Nexus 3000, 3500, and Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Nx-os | >=7.0\(3\)i7<7.0\(3\)i7\(4\) | |
| Cisco Nexus 3000 | ||
| Cisco Nexus 9000 | ||
| Cisco Nx-os | >=7.0\(3\)<7.0\(3\)i7\(4\) | |
| Cisco Nexus 3500 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1606?
CVE-2019-1606 is a vulnerability in the CLI of Cisco NX-OS Software that allows an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device.
How does CVE-2019-1606 occur?
CVE-2019-1606 occurs due to insufficient validation of arguments passed to certain CLI commands in Cisco NX-OS Software.
What is the severity of CVE-2019-1606?
The severity of CVE-2019-1606 is high with a CVSS score of 7.8.
Which software versions of Cisco NX-OS are affected by CVE-2019-1606?
The versions affected by CVE-2019-1606 are between 7.0(3)i7 and 7.0(3)i7(4) of Cisco NX-OS Software.
How can I fix CVE-2019-1606?
To fix CVE-2019-1606, Cisco recommends upgrading to a fixed software release.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco nx-os
- version/cisco nx-os/7.0\(3\)i7
- canonical/cisco nexus 3000
- canonical/cisco nexus 9000
- version/cisco nx-os/7.0\(3\)
- canonical/cisco nexus 3500