CVE-2019-1812: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a…

Medium severity · published May 15, 2019

CVE-2019-1812

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a…

6.7

CVSS

0.3%

EPSS

On KEV

Description

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 27% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nx-os · Cisco

6.0\(2\) before 7.0\(3\)i7\(5\); 9.2 before 9.2\(2\); 7.0\(3\) before 7.0\(3\)f3\(5\); 9.2 before 9.2\(2\); before 7.0\(3\)i7\(5\); 9.2 before 9.2\(2\) · source: NVD

Affected product

Nx-os

Cisco

All Nx-os CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-1812

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-1812

Broken Link

http://www.securityfocus.com/bid/108425

Vendor Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2