cisco-sa-20190306-nxos-NXAPI-cmdinj: Cisco NX-OS Software NX-API Command Injection Vulnerability
First published: Wed Mar 06 2019(Updated: )
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to incorrect input validation of user-supplied data by the NX-API subsystem. An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to perform a command-injection attack and execute arbitrary commands with root privileges. Note: NX-API is disabled by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinj
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco NX-OS Software | =8.1<8.1(1b)=7.3<8.1(1b) | 8.1(1b) 8.1(1b) |
| Cisco NX-OS Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco NX-OS Software vulnerability?
The vulnerability ID for this Cisco NX-OS Software vulnerability is cisco-sa-20190306-nxos-NXAPI-cmdinj.
What is the severity of the Cisco NX-OS Software NX-API Command Injection Vulnerability?
The severity of the Cisco NX-OS Software NX-API Command Injection Vulnerability is high. The severity value is 8.8.
How does the Cisco NX-OS Software NX-API Command Injection Vulnerability occur?
The Cisco NX-OS Software NX-API Command Injection Vulnerability occurs due to incorrect input validation of user-supplied data by the NX-API subsystem.
Which version of Cisco NX-OS Software is affected?
The versions affected by the Cisco NX-OS Software NX-API Command Injection Vulnerability are 8.1 up to but excluding 8.1(1b), and 7.3.
Is there a remedy available for the affected version of Cisco NX-OS Software?
Yes, the remedy for the affected version of Cisco NX-OS Software is version 8.1(1b).
- agent/first-publish-date
- agent/softwarecombine
- agent/type
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/title
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/event
- agent/description
- agent/tags
- vendor/cisco
- canonical/cisco nx-os software
- version/cisco nx-os software/8.1
- version/cisco nx-os software/7.3