Lucene search

CiscoCVE-2019-1589

HistoryMay 03, 2019 - 3:29 p.m.

CVE-2019-1589

2019-05-0315:29:00

CWE-200

CWE-311

cisco

web.nvd.nist.gov

cisco nexus 9000

tpm

vulnerability

aci

data protection

disk encryption

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

27.8%

JSON

A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, local attacker with physical access to view sensitive information on an affected device. The vulnerability is due to a lack of proper data-protection mechanisms for disk encryption keys that are used within the partitions on an affected device hard drive. An attacker could exploit this vulnerability by obtaining physical access to the affected device to view certain cleartext keys. A successful exploit could allow the attacker to execute a custom boot process or conduct further attacks on an affected device.

Affected configurations

Nvd

Vulners

Node

cisconx-osMatch8.3\(0\)sk\(0.39\)

AND

cisconexus_9000Match-

cisconexus_92160yc-xMatch-

cisconexus_92300ycMatch-

cisconexus_92304qcMatch-

cisconexus_9236cMatch-

cisconexus_9272qMatch-

cisconexus_93108tc-exMatch-

cisconexus_93108tc-fxMatch-

cisconexus_93120txMatch-

cisconexus_93128txMatch-

cisconexus_93180lc-exMatch-

cisconexus_93180yc-exMatch-

cisconexus_93180yc-fxMatch-

cisconexus_93240yc-fx2Match-

cisconexus_9332cMatch-

cisconexus_9332pqMatch-

cisconexus_9336c-fx2Match-

cisconexus_9336pqMatch-

cisconexus_9348gc-fxpMatch-

cisconexus_9364cMatch-

cisconexus_9372pxMatch-

cisconexus_9372px-eMatch-

cisconexus_9372txMatch-

cisconexus_9372tx-eMatch-

cisconexus_9396pxMatch-

cisconexus_9396txMatch-

cisconexus_9508Match-

VendorProductVersionCPE
cisconx-os8.3(0)sk(0.39)cpe:2.3:o:cisco:nx-os:8.3\(0\)sk\(0.39\):*:*:*:*:*:*:*
cisconexus_9000-cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*
cisconexus_92160yc-x-cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*
cisconexus_92300yc-cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*
cisconexus_92304qc-cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*
cisconexus_9236c-cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*
cisconexus_9272q-cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*
cisconexus_93108tc-ex-cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*
cisconexus_93108tc-fx-cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*
cisconexus_93120tx-cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	nx-os	8.3(0)sk(0.39)	cpe:2.3:o:cisco:nx-os:8.3\(0\)sk\(0.39\):::::::*
cisco	nexus_9000	-	cpe:2.3:h:cisco:nexus_9000:-:::::::*
cisco	nexus_92160yc-x	-	cpe:2.3:h:cisco:nexus_92160yc-x:-:::::::*
cisco	nexus_92300yc	-	cpe:2.3:h:cisco:nexus_92300yc:-:::::::*
cisco	nexus_92304qc	-	cpe:2.3:h:cisco:nexus_92304qc:-:::::::*
cisco	nexus_9236c	-	cpe:2.3:h:cisco:nexus_9236c:-:::::::*
cisco	nexus_9272q	-	cpe:2.3:h:cisco:nexus_9272q:-:::::::*
cisco	nexus_93108tc-ex	-	cpe:2.3:h:cisco:nexus_93108tc-ex:-:::::::*
cisco	nexus_93108tc-fx	-	cpe:2.3:h:cisco:nexus_93108tc-fx:-:::::::*
cisco	nexus_93120tx	-	cpe:2.3:h:cisco:nexus_93120tx:-:::::::*

Rows per page:

1-10 of 281

CNA Affected

[
  {
    "product": "Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "8.3(0)SK(0.39)"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108175

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-aci-unmeasured-boot

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

27.8%

JSON

Related for CVE-2019-1589