Medium severity · published May 15, 2019
CVE-2019-1781
A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating…
6.7
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FX
Fx-os · Cisco
before 2.2.2.91; 2.3 before 2.3.1.130; 2.4 before 2.4.1.222 · source: NVD
NX
Nx-os · Cisco
5.2 before 6.2\(25\); 7.3 before 8.3\(2\); before 7.0\(3\)i4\(9\); 7.0\(3\)i7 before 7.0\(3\)i7\(4\); before 7.3\(4\)n1\(1\); before 6.2\(22\); +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1781
Third Party Advisory
http://www.securityfocus.com/bid/108407
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782
More from Fx-os
8.6
CVE-2019-1858
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote…
6.7
CVE-2019-1782
A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating…
6.7
CVE-2019-1611
Cisco FXOS and NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1611)
6.5
CVE-2019-1963
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, remote…
