CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:S/C:C/I:C/A:C
EPSS
Percentile
5.1%
A vulnerability in the TACACS+ command authorization code of Cisco NX-OS Software could allow an authenticated, local attacker to execute certain commands without TACACS+ server authorization.
The vulnerability is due to the processing of certain commands when executed in a sequence. An attacker could exploit this vulnerability by executing multiple commands in a sequence. A successful exploit could allow the attacker to execute certain commands without TACACS+ server authorization.
Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.
To exploit this vulnerability, an attacker must have local access to an affected device. This access requirement reduces the possibility of a successful exploit.
Cisco indicates through the CVSS score that proof-of-concept exploit code exists; however, the code is not known to be publicly available.
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | nx_os | 4.1 | cpe:2.3:o:cisco:nx_os:4.1:*:*:*:*:*:*:* |
cisco | nx_os | 5.0 | cpe:2.3:o:cisco:nx_os:5.0:*:*:*:*:*:*:* |
cisco | nx_os | 4.2 | cpe:2.3:o:cisco:nx_os:4.2:*:*:*:*:*:*:* |
cisco | nx_os | 5.1 | cpe:2.3:o:cisco:nx_os:5.1:*:*:*:*:*:*:* |
cisco | nx_os | 5.2 | cpe:2.3:o:cisco:nx_os:5.2:*:*:*:*:*:*:* |
cisco | nx_os | 6.1 | cpe:2.3:o:cisco:nx_os:6.1:*:*:*:*:*:*:* |
cisco | nx_os | 6.0 | cpe:2.3:o:cisco:nx_os:6.0:*:*:*:*:*:*:* |
cisco | nx_os | 6.2 | cpe:2.3:o:cisco:nx_os:6.2:*:*:*:*:*:*:* |
cisco | nx_os | 4.1(2) | cpe:2.3:o:cisco:nx_os:4.1\(2\):*:*:*:*:*:*:* |
cisco | nx_os | 4.1(3) | cpe:2.3:o:cisco:nx_os:4.1\(3\):*:*:*:*:*:*:* |