CVE-2019-1726 (GCVE-0-2019-1726)
Vulnerability from cvelistv5 – Published: 2019-05-15 16:40 – Updated: 2024-11-21 19:31
VLAI?
Summary
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.
Severity ?
5.3 (Medium)
CWE
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco NX-OS Software |
Affected:
unspecified , < 6.2(25)
(custom)
Affected: unspecified , < 8.3(2) (custom) Affected: unspecified , < 7.0(3)I7(3) (custom) Affected: unspecified , < 9.2(1) (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:28:42.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass"
},
{
"name": "108409",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108409"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-1726",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-21T18:58:44.236098Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T19:31:38.707Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco NX-OS Software",
"vendor": "Cisco",
"versions": [
{
"lessThan": "6.2(25)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "8.3(2)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "7.0(3)I7(3)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "9.2(1)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2019-05-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-22T13:06:04",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass"
},
{
"name": "108409",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108409"
}
],
"source": {
"advisory": "cisco-sa-20190515-nxos-cli-bypass",
"defect": [
[
"CSCvh24771",
"CSCvi99247",
"CSCvi99248",
"CSCvi99250",
"CSCvi99251",
"CSCvi99252",
"CSCvn11851"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2019-05-15T16:00:00-0700",
"ID": "CVE-2019-1726",
"STATE": "PUBLIC",
"TITLE": "Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco NX-OS Software",
"version": {
"version_data": [
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "6.2(25)"
},
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "8.3(2)"
},
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "7.0(3)I7(3)"
},
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "9.2(1)"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass"
},
{
"name": "108409",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108409"
}
]
},
"source": {
"advisory": "cisco-sa-20190515-nxos-cli-bypass",
"defect": [
[
"CSCvh24771",
"CSCvi99247",
"CSCvi99248",
"CSCvi99250",
"CSCvi99251",
"CSCvi99252",
"CSCvn11851"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2019-1726",
"datePublished": "2019-05-15T16:40:17.248159Z",
"dateReserved": "2018-12-06T00:00:00",
"dateUpdated": "2024-11-21T19:31:38.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.2\", \"versionEndExcluding\": \"6.2\\\\(25\\\\)\", \"matchCriteriaId\": \"E762B981-6AC3-41E2-9FF5-DBA9616EA75C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.3\", \"versionEndExcluding\": \"8.3\\\\(2\\\\)\", \"matchCriteriaId\": \"BC0041E4-EBDC-465A-B593-E7C353EF0D8F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FD00AB9-F2DD-4D07-8DFF-E7B34824D66A\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:mds_9100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54C0D908-D7BA-48C3-9963-14A3A32A2662\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:mds_9200:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B25B92ED-37C0-4653-9C5E-B4C13C46464C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:mds_9500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2374E02D-46FE-477F-A74D-49E72149E6EC\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:mds_9700:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C44335D8-8A78-486C-A325-9691FA4C3271\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0\\\\(3\\\\)i7\", \"versionEndExcluding\": \"7.0\\\\(3\\\\)i7\\\\(3\\\\)\", \"matchCriteriaId\": \"D857756F-8C20-4B59-BA89-8373954B0093\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10FFC5E8-CC5A-4D31-A63A-19E72EC442AB\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41C14CC9-C244-4B86-AEA6-C50BAD5DA9A6\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D14D4B4E-120E-4607-A4F1-447C7BF3052E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"15702ACB-29F3-412D-8805-E107E0729E35\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32A532C0-B0E3-484A-B356-88970E7D0248\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43913A0E-50D5-47DD-94D8-DD3391633619\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8E1073F-D374-4311-8F12-AD8C72FAA293\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"97217080-455C-48E4-8CE1-6D5B9485864F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8EBEBA5B-5589-417B-BF3B-976083E9FE54\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"532CE4B0-A3C9-4613-AAAF-727817D06FB4\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"92E2CB2B-DA11-4CF7-9D57-3D4D48990DC0\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63BE0266-1C00-4D6A-AD96-7F82532ABAA7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0\\\\(2\\\\)a8\\\\(11\\\\)\", \"matchCriteriaId\": \"81FEA96D-5A66-415A-B46C-F25DC3E4E5EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0\\\\(3\\\\)\", \"versionEndExcluding\": \"7.0\\\\(3\\\\)i7\\\\(3\\\\)\", \"matchCriteriaId\": \"521D7202-7B57-49C1-BFC5-6829B96428BA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10F80A72-AD54-4699-B8AE-82715F0B58E2\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9354B6A2-D7D6-442E-BF4C-FE8A336D9E94\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"74CB4002-7636-4382-B33E-FBA060A13C34\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10CEBF73-3EE0-459A-86C5-F8F6243FE27C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.3\\\\(4\\\\)n1\\\\(1\\\\)\", \"matchCriteriaId\": \"EA0C7252-4931-47EF-9AFD-0CE05C786613\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BFC8699E-81C0-4374-B827-71B3916B910D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"870F4379-68F6-4B34-B99B-107DFE0DBD63\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6A58223F-3B15-420B-A6D4-841451CF0380\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.2\\\\(22\\\\)\", \"matchCriteriaId\": \"A67D92F3-7EE1-4CFD-9608-4E35994C1BC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.2\", \"versionEndExcluding\": \"7.3\\\\(3\\\\)d1\\\\(1\\\\)\", \"matchCriteriaId\": \"3411F8C2-D65A-46CF-9563-0A9866462491\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0\", \"versionEndExcluding\": \"8.3\\\\(2\\\\)\", \"matchCriteriaId\": \"114F8E8A-31E1-4865-B1AA-07E51D10CF90\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12180BEB-7F21-4FA7-ABD2-E9A8EA7340F3\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD7A4B4B-3BB1-4A4D-911E-C4EEF01BBC45\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.0\\\\(1d\\\\)\", \"matchCriteriaId\": \"27F8E672-D0C7-47CD-9FBA-FCDF3C89A2E9\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ucs_6248up:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49112D3F-DFAD-4E71-992B-9E0640FA388C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ucs_6296up:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38A1D8F2-A4A6-4BAC-8326-9F9DE9572FA2\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la CLI del programa NX-OS de Cisco, podr\\u00eda permitir a un atacante local autenticado ingresar a servicios internos que deber\\u00edan estar restringidos en un dispositivo afectado, como la API NX. La vulnerabilidad se debe a una comprobaci\\u00f3n insuficiente de los argumentos pasados ??a un ciertos comando CLI. Un atacante podr\\u00eda explotar esta vulnerabilidad si inserta una entrada maliciosa como argumento para el comando afectado. Una explotaci\\u00f3n exitosa podr\\u00eda permitir al atacante omitir las restricciones previstas y acceder a los servicios internos del dispositivo. Un atacante requerir\\u00eda credenciales de dispositivo v\\u00e1lidas para atacar esta vulnerabilidad.\"}]",
"id": "CVE-2019-1726",
"lastModified": "2024-11-21T04:37:11.267",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-05-15T17:29:01.467",
"references": "[{\"url\": \"http://www.securityfocus.com/bid/108409\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/108409\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-1726\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2019-05-15T17:29:01.467\",\"lastModified\":\"2024-11-21T04:37:11.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la CLI del programa NX-OS de Cisco, podr\u00eda permitir a un atacante local autenticado ingresar a servicios internos que deber\u00edan estar restringidos en un dispositivo afectado, como la API NX. La vulnerabilidad se debe a una comprobaci\u00f3n insuficiente de los argumentos pasados ??a un ciertos comando CLI. Un atacante podr\u00eda explotar esta vulnerabilidad si inserta una entrada maliciosa como argumento para el comando afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante omitir las restricciones previstas y acceder a los servicios internos del dispositivo. Un atacante requerir\u00eda credenciales de dispositivo v\u00e1lidas para atacar esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"6.2\\\\(25\\\\)\",\"matchCriteriaId\":\"E762B981-6AC3-41E2-9FF5-DBA9616EA75C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.3\",\"versionEndExcluding\":\"8.3\\\\(2\\\\)\",\"matchCriteriaId\":\"BC0041E4-EBDC-465A-B593-E7C353EF0D8F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD00AB9-F2DD-4D07-8DFF-E7B34824D66A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:mds_9100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54C0D908-D7BA-48C3-9963-14A3A32A2662\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:mds_9200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B25B92ED-37C0-4653-9C5E-B4C13C46464C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:mds_9500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2374E02D-46FE-477F-A74D-49E72149E6EC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:mds_9700:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C44335D8-8A78-486C-A325-9691FA4C3271\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\\\\(3\\\\)i7\",\"versionEndExcluding\":\"7.0\\\\(3\\\\)i7\\\\(3\\\\)\",\"matchCriteriaId\":\"D857756F-8C20-4B59-BA89-8373954B0093\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10FFC5E8-CC5A-4D31-A63A-19E72EC442AB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41C14CC9-C244-4B86-AEA6-C50BAD5DA9A6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D14D4B4E-120E-4607-A4F1-447C7BF3052E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15702ACB-29F3-412D-8805-E107E0729E35\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32A532C0-B0E3-484A-B356-88970E7D0248\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43913A0E-50D5-47DD-94D8-DD3391633619\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8E1073F-D374-4311-8F12-AD8C72FAA293\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97217080-455C-48E4-8CE1-6D5B9485864F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EBEBA5B-5589-417B-BF3B-976083E9FE54\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"532CE4B0-A3C9-4613-AAAF-727817D06FB4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92E2CB2B-DA11-4CF7-9D57-3D4D48990DC0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63BE0266-1C00-4D6A-AD96-7F82532ABAA7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0\\\\(2\\\\)a8\\\\(11\\\\)\",\"matchCriteriaId\":\"81FEA96D-5A66-415A-B46C-F25DC3E4E5EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\\\\(3\\\\)\",\"versionEndExcluding\":\"7.0\\\\(3\\\\)i7\\\\(3\\\\)\",\"matchCriteriaId\":\"521D7202-7B57-49C1-BFC5-6829B96428BA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10F80A72-AD54-4699-B8AE-82715F0B58E2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9354B6A2-D7D6-442E-BF4C-FE8A336D9E94\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74CB4002-7636-4382-B33E-FBA060A13C34\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10CEBF73-3EE0-459A-86C5-F8F6243FE27C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.3\\\\(4\\\\)n1\\\\(1\\\\)\",\"matchCriteriaId\":\"EA0C7252-4931-47EF-9AFD-0CE05C786613\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFC8699E-81C0-4374-B827-71B3916B910D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"870F4379-68F6-4B34-B99B-107DFE0DBD63\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A58223F-3B15-420B-A6D4-841451CF0380\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.2\\\\(22\\\\)\",\"matchCriteriaId\":\"A67D92F3-7EE1-4CFD-9608-4E35994C1BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2\",\"versionEndExcluding\":\"7.3\\\\(3\\\\)d1\\\\(1\\\\)\",\"matchCriteriaId\":\"3411F8C2-D65A-46CF-9563-0A9866462491\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0\",\"versionEndExcluding\":\"8.3\\\\(2\\\\)\",\"matchCriteriaId\":\"114F8E8A-31E1-4865-B1AA-07E51D10CF90\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12180BEB-7F21-4FA7-ABD2-E9A8EA7340F3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD7A4B4B-3BB1-4A4D-911E-C4EEF01BBC45\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0\\\\(1d\\\\)\",\"matchCriteriaId\":\"27F8E672-D0C7-47CD-9FBA-FCDF3C89A2E9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ucs_6248up:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49112D3F-DFAD-4E71-992B-9E0640FA388C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ucs_6296up:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38A1D8F2-A4A6-4BAC-8326-9F9DE9572FA2\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/108409\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/108409\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\", \"name\": \"20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/108409\", \"name\": \"108409\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T18:28:42.237Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2019-1726\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-21T18:58:44.236098Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-21T19:00:11.216Z\"}}], \"cna\": {\"title\": \"Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability\", \"source\": {\"defect\": [[\"CSCvh24771\", \"CSCvi99247\", \"CSCvi99248\", \"CSCvi99250\", \"CSCvi99251\", \"CSCvi99252\", \"CSCvn11851\"]], \"advisory\": \"cisco-sa-20190515-nxos-cli-bypass\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"cvssV3_0\": {\"scope\": \"UNCHANGED\", \"version\": \"3.0\", \"baseScore\": 5.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco NX-OS Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"6.2(25)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"8.3(2)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"7.0(3)I7(3)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"9.2(1)\", \"versionType\": \"custom\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"datePublic\": \"2019-05-15T00:00:00\", \"references\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\", \"name\": \"20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\"]}, {\"url\": \"http://www.securityfocus.com/bid/108409\", \"name\": \"108409\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2019-05-22T13:06:04\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"version\": \"3.0\", \"baseScore\": \"5.3\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\"}}, \"source\": {\"defect\": [[\"CSCvh24771\", \"CSCvi99247\", \"CSCvi99248\", \"CSCvi99250\", \"CSCvi99251\", \"CSCvi99252\", \"CSCvn11851\"]], \"advisory\": \"cisco-sa-20190515-nxos-cli-bypass\", \"discovery\": \"INTERNAL\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"affected\": \"\u003c\", \"version_value\": \"6.2(25)\", \"version_affected\": \"\u003c\"}, {\"affected\": \"\u003c\", \"version_value\": \"8.3(2)\", \"version_affected\": \"\u003c\"}, {\"affected\": \"\u003c\", \"version_value\": \"7.0(3)I7(3)\", \"version_affected\": \"\u003c\"}, {\"affected\": \"\u003c\", \"version_value\": \"9.2(1)\", \"version_affected\": \"\u003c\"}]}, \"product_name\": \"Cisco NX-OS Software\"}]}, \"vendor_name\": \"Cisco\"}]}}, \"exploit\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass\", \"name\": \"20190515 Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability\", \"refsource\": \"CISCO\"}, {\"url\": \"http://www.securityfocus.com/bid/108409\", \"name\": \"108409\", \"refsource\": \"BID\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-20\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2019-1726\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Cisco NX-OS Software CLI Bypass to Internal Service Vulnerability\", \"ASSIGNER\": \"psirt@cisco.com\", \"DATE_PUBLIC\": \"2019-05-15T16:00:00-0700\"}}}}",
"cveMetadata": "{\"cveId\": \"CVE-2019-1726\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-21T19:31:38.707Z\", \"dateReserved\": \"2018-12-06T00:00:00\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2019-05-15T16:40:17.248159Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…