cisco-sa-3000-9000-fileaction-QtLzDRy2: Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
First published: Wed Feb 24 2021(Updated: )
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration. For example, the attacker could add a user account without the device administrator knowing. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-3000-9000-fileaction-QtLzDRy2 This advisory is part of the February 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: February 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.
Credit: an anonymous reporter for finding this vulnerability.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco NX-OS | ||
| Cisco Nexus Series | ||
| Cisco Nexus Series |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-3000-9000-fileaction-QtLzDRy2?
The cisco-sa-3000-9000-fileaction-QtLzDRy2 vulnerability is classified as high severity.
How do I fix cisco-sa-3000-9000-fileaction-QtLzDRy2?
To fix cisco-sa-3000-9000-fileaction-QtLzDRy2, you should upgrade to a fixed version of the Cisco NX-OS software as recommended in the security advisory.
Who is affected by cisco-sa-3000-9000-fileaction-QtLzDRy2?
The cisco-sa-3000-9000-fileaction-QtLzDRy2 vulnerability affects Cisco Nexus 3000 Series and Nexus 9000 Series Switches running standalone NX-OS mode.
What types of attacks can exploit cisco-sa-3000-9000-fileaction-QtLzDRy2?
An unauthenticated, remote attacker can exploit cisco-sa-3000-9000-fileaction-QtLzDRy2 to create, delete, or modify files on the affected devices.
Is there a workaround for cisco-sa-3000-9000-fileaction-QtLzDRy2?
There are no reported workarounds for cisco-sa-3000-9000-fileaction-QtLzDRy2; upgrading to a patched version is recommended.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/remedy
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco nx-os
- canonical/cisco nexus series