cisco-sa-nfvis-g2DMVVh: Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability
A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator. This vulnerability is due to incomplete validation of user-supplied input that is passed to an authentication script. An attacker could exploit this vulnerability by injecting parameters into an authentication request. A successful exploit could allow the attacker to bypass authentication and log in as an administrator to the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-g2DMVVh
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-nfvis-g2DMVVh?
The cisco-sa-nfvis-g2DMVVh vulnerability is considered high due to its potential to allow unauthenticated remote access as an administrator.
How do I fix cisco-sa-nfvis-g2DMVVh?
To fix the cisco-sa-nfvis-g2DMVVh vulnerability, update your Cisco Enterprise NFV Infrastructure Software to the latest patched version provided by Cisco.
What could an attacker exploit in cisco-sa-nfvis-g2DMVVh?
An attacker could exploit cisco-sa-nfvis-g2DMVVh to bypass authentication mechanisms and gain administrative access to affected Cisco devices.
What products are affected by cisco-sa-nfvis-g2DMVVh?
The cisco-sa-nfvis-g2DMVVh vulnerability affects Cisco Enterprise NFV Infrastructure Software.
Is authentication affected by cisco-sa-nfvis-g2DMVVh?
Yes, the cisco-sa-nfvis-g2DMVVh vulnerability allows for the bypassing of authentication in Cisco Enterprise NFV Infrastructure Software.