cisco-sa-20190306-nxos-privesca: Cisco NX-OS Software Privilege Escalation Vulnerability
First published: Wed Mar 06 2019(Updated: )
A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID (GID). An attacker could exploit this vulnerability by taking advantage of a logic error that will permit the use of higher privileged commands than what is necessarily assigned. A successful exploit could allow an attacker to execute commands with elevated privileges on the underlying Linux shell of an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-privesca This advisory is part of the March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication, which includes 25 Cisco Security Advisories that describe 26 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco NX-OS Software | ||
| Cisco NX-OS Software | =6.0(2)A8<6.0(2)A8(11)=Prior to 6.0(2)A8<6.0(2)A8(11) | 6.0(2)A8(11) 6.0(2)A8(11) |
| Cisco NX-OS Software | =6.2<6.2(22)=Prior to 6.2<6.2(22) | 6.2(22) 6.2(22) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco NX-OS Software vulnerability?
The vulnerability ID for this Cisco NX-OS Software vulnerability is cisco-sa-20190306-nxos-privesca.
What is the severity rating of cisco-sa-20190306-nxos-privesca?
The severity rating of cisco-sa-20190306-nxos-privesca is high with a rating of 7.3.
How does the vulnerability in Cisco NX-OS Software allow privilege escalation?
The vulnerability in Cisco NX-OS Software allows an authenticated, local attacker to gain elevated privileges on the affected device due to an incorrect authorization check.
Which versions of Cisco NX-OS Software are affected by cisco-sa-20190306-nxos-privesca?
The versions of Cisco NX-OS Software affected by cisco-sa-20190306-nxos-privesca are 6.0(2)A8(11), 6.2(22), and prior versions.
Is there a remedy available for cisco-sa-20190306-nxos-privesca?
There is no specific remedy mentioned for cisco-sa-20190306-nxos-privesca, please refer to the Cisco Security Advisory for more information.
- agent/last-modified-date
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/title
- agent/weakness
- agent/severity
- agent/references
- agent/event
- agent/description
- agent/tags
- vendor/cisco
- canonical/cisco nx-os software
- version/cisco nx-os software/6.0(2)a8
- version/cisco nx-os software/prior to 6.0(2)a8
- version/cisco nx-os software/6.2
- version/cisco nx-os software/prior to 6.2