First published: Wed May 15 2019(Updated: )
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco Nx-os | <7.3\(5\)n1\(1\) | |
Cisco Nexus 5548p | ||
Cisco Nexus 5548up | ||
Cisco Nexus 5596t | ||
Cisco Nexus 5596up | ||
Cisco Nexus 56128p | ||
Cisco Nexus 5624q | ||
Cisco Nexus 5648q | ||
Cisco Nexus 5672up | ||
Cisco Nexus 5696q | ||
Cisco Nexus 6001 | ||
Cisco Nexus 6004 | ||
Cisco Nx-os | >=7.2<7.3\(3\)d1\(1\) | |
Cisco Nx-os | >=8.0<8.2\(3\) | |
Cisco Nx-os | >=8.3<8.3\(1\) | |
Cisco 7000 | ||
Cisco 7700 | ||
Cisco Nx-os | <4.0\(1a\) | |
Cisco Ucs 6248up | ||
Cisco Ucs 6296up | ||
Cisco Ucs 6324 | ||
Cisco Ucs 6332 | ||
Cisco Ucs 6332-16up |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-1784 is a vulnerability in the CLI of Cisco NX-OS Software that allows an authenticated, local attacker to execute arbitrary commands with root privilege.
CVE-2019-1784 has a severity rating of 6.7 (high).
Cisco NX-OS Software versions up to 7.3(5)n1(1) are affected by CVE-2019-1784.
To fix CVE-2019-1784, upgrade Cisco NX-OS Software to a version beyond 7.3(5)n1(1).
More information about CVE-2019-1784 can be found at the following references: http://www.securityfocus.com/bid/108369, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmd-inject-1784