Lucene search

CiscoCVE-2019-1810

HistoryMay 15, 2019 - 11:29 p.m.

CVE-2019-1810

2019-05-1523:29:01

CWE-347

cisco

web.nvd.nist.gov

cve-2019-1810

image signature verification

nx-os

cli

cisco nexus 3000 series

cisco nexus 9000 series

vulnerability

cisco security advisory

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the attacker to boot a malicious software image.

Affected configurations

Nvd

Vulners

Node

cisconx-osRange6.1\(2\)i3\(4\)–7.0\(3\)i7\(5\)

cisconx-osRange7.0\(3\)i7\(5a\)–9.2\(2\)

AND

ciscon3k-c3164qMatch-

Node

cisconx-osRange7.0\(3\)i3\(1\)–7.0\(3\)i7\(1\)

cisconx-osRange7.0\(3\)i7\(2\)–9.2\(1\)

AND

ciscon3k-c3232cMatch-

Node

cisconx-osRange7.0\(3\)i4\(1\)–7.0\(3\)i7\(5\)

cisconx-osRange7.0\(3\)i7\(5a\)–9.2\(2\)

AND

ciscon9k-c92304qcMatch-

Node

cisconx-osRange7.0\(3\)i4\(2\)–7.0\(3\)i7\(5\)

cisconx-osRange7.0\(3\)i7\(5a\)–9.2\(2\)

AND

ciscon9k-c9232cMatch-

VendorProductVersionCPE
cisconx-os*cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
ciscon3k-c3164q-cpe:2.3:h:cisco:n3k-c3164q:-:*:*:*:*:*:*:*
ciscon3k-c3232c-cpe:2.3:h:cisco:n3k-c3232c:-:*:*:*:*:*:*:*
ciscon9k-c92304qc-cpe:2.3:h:cisco:n9k-c92304qc:-:*:*:*:*:*:*:*
ciscon9k-c9232c-cpe:2.3:h:cisco:n9k-c9232c:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	nx-os	*	cpe:2.3:o:cisco:nx-os::::::::
cisco	n3k-c3164q	-	cpe:2.3:h:cisco:n3k-c3164q:-:::::::*
cisco	n3k-c3232c	-	cpe:2.3:h:cisco:n3k-c3232c:-:::::::*
cisco	n9k-c92304qc	-	cpe:2.3:h:cisco:n9k-c92304qc:-:::::::*
cisco	n9k-c9232c	-	cpe:2.3:h:cisco:n9k-c9232c:-:::::::*

CNA Affected

[
  {
    "product": "Cisco NX-OS Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "8.3(1)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108431

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-1810