cisco-sa-20190306-nx-os-api-ex: Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability
First published: Wed Mar 06 2019(Updated: )
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to incorrect input validation in the NX-API feature. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS request to an internal service on an affected device that has the NX-API feature enabled. A successful exploit could allow the attacker to cause a buffer overflow and execute arbitrary code as root. Note: The NX-API feature is disabled by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nx-os-api-ex
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco NX-OS Software | ||
| Cisco NX-OS Software | =7.0(3)F3<7.0(3)F3(3c)1 | 7.0(3)F3(3c)1 |
| Cisco NX-OS Software | =7.0(3)F3<7.0(3)F3(3c)1=7.0(3)F2<7.0(3)F3(3c)1=7.0(3)F1<7.0(3)F3(3c)1 | 7.0(3)F3(3c)1 7.0(3)F3(3c)1 7.0(3)F3(3c)1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability?
A vulnerability in the NX-API feature of Cisco NX-OS Software that allows an authenticated, local attacker to execute arbitrary code as root.
How severe is the Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability?
The severity of this vulnerability is rated as 7.8 (High).
How can the Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability be exploited?
The vulnerability can be exploited by sending a crafted HTTP or HTTPS request to the affected system.
Which versions of Cisco NX-OS Software are affected by the NX-API Arbitrary Code Execution Vulnerability?
Versions 7.0(3)F3 up to 7.0(3)F3(3c)1 of Cisco NX-OS Software are affected.
- agent/type
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/title
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/event
- agent/description
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- vendor/cisco
- canonical/cisco nx-os software
- version/cisco nx-os software/7.0(3)f3
- version/cisco nx-os software/7.0(3)f2
- version/cisco nx-os software/7.0(3)f1