CVE-2019-1613

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-1613
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(27) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(6). Nexus 3500 Platform Switches are affected running software versions prior to 6.0(2)A8(11) and 7.0(3)I7(6). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9), 7.0(3)I7(6). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22) and 8.2(3).

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/107392 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1613 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(3\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(2\):*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:9432pq:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:9536pq:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:9636pq:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:9736pq:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9432c-s:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9464px:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9464tx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9564px:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9564tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9636c-r:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9636c-rx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x97160yc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9732c-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9732c-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9736c-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9736c-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n9k-x9788tc-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9316d-gx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_93600cd-gx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:x9636q-r:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:cisco:nx-os:9.2\(1\):*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:n3k-c31128pq-10ge:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n3k-c3132c-z:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n3k-c3164q-40ge:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n3k-c3264q:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(2\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:8.2\(1\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:nx-os:9.2\(2\):*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:n77-f312ck-26:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-f324fq-25:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-f348xp-23:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-f430cq-36:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-m312cq-26l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-m324fq-25l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n77-m348xp-23l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-f248xp-25e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-f306ck-25:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-f312fq-25:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-m202cf-22l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-m206fq-23l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-m224xp-23l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-m324fq-25l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:n7k-m348xp-25l:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2019-03-11 21:29

Updated : 2024-02-04 20:20

NVD link : CVE-2019-1613

Mitre link : CVE-2019-1613

CVE.ORG link : CVE-2019-1613

JSON object : View

Products Affected

cisco

  • n7k-f248xp-25e
  • n7k-f306ck-25
  • nexus_9508
  • nexus_9332c
  • nexus_9516
  • n9k-x9564tx
  • 9536pq
  • nexus_93108tc-ex
  • nexus_93180lc-ex
  • nexus_93240yc-fx2
  • n3k-c3164q-40ge
  • n77-m312cq-26l
  • n7k-m224xp-23l
  • nexus_9348gc-fxp
  • n3k-c3264q
  • n77-m324fq-25l
  • n9k-x9464px
  • nexus_93180yc-fx
  • nexus_9364c
  • n9k-x9736c-fx
  • n7k-f312fq-25
  • n9k-x97160yc-ex
  • nexus_92300yc
  • x9636q-r
  • n3k-c3132c-z
  • n7k-m324fq-25l
  • nexus_9272q
  • n9k-x9732c-ex
  • n77-f324fq-25
  • n9k-x9464tx2
  • n9k-x9564px
  • nexus_92304qc
  • nexus_9504
  • nexus_9236c
  • nexus_93180yc-ex
  • nexus_9336c-fx2
  • nexus_93600cd-gx
  • n77-m348xp-23l
  • n7k-m202cf-22l
  • nexus_93108tc-fx
  • n9k-x9432c-s
  • n77-f312ck-26
  • n7k-m348xp-25l
  • n7k-m206fq-23l
  • n77-f430cq-36
  • n9k-x9636c-rx
  • n9k-x9732c-fx
  • n9k-x9736c-ex
  • n77-f348xp-23
  • n3k-c31128pq-10ge
  • 9432pq
  • nx-os
  • n9k-x9636c-r
  • nexus_92160yc-x
  • n9k-x9788tc-fx
  • nexus_93120tx
  • 9636pq
  • nexus_9316d-gx
  • 9736pq
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')