CVE-2019-1610: Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1610)
First published: Wed Mar 06 2019(Updated: )
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3500 Platform Switches and Nexus 3000 Series Switches software versions prior to 7.0(3)I7(4) are affected.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Nx-os | >=7.0\(3\)<=7.0\(3\)i7\(4\) | |
| Cisco Nexus 3500 Platform | ||
| Cisco Nx-os | <7.0\(3\)i7\(4\) | |
| Cisco Nexus 3000 Series |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1610?
CVE-2019-1610 is a vulnerability in the CLI of Cisco NX-OS Software that could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device.
How does CVE-2019-1610 impact Cisco NX-OS Software?
CVE-2019-1610 allows an authenticated, local attacker to execute arbitrary commands on the affected device's operating system.
What is the severity score of CVE-2019-1610?
CVE-2019-1610 has a severity score of 6.7, which is considered high.
How can the vulnerability in CVE-2019-1610 be exploited?
An attacker can exploit CVE-2019-1610 by passing malicious arguments to certain CLI commands in Cisco NX-OS Software.
Are there any references for CVE-2019-1610?
Yes, you can find more information about CVE-2019-1610 at the following references: - http://www.securityfocus.com/bid/107338 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1610
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco nx-os
- version/cisco nx-os/7.0\(3\)
- version/cisco nx-os/7.0\(3\)i7\(4\)
- canonical/cisco nexus 3500 platform
- canonical/cisco nexus 3000 series