CVE-2018-0294

Vulnerability

The vulnerability resides in the write-erase feature of Cisco FXOS and NX-OS Software. When certain CLI commands are used to clear the device configuration and reload, the software fails to properly delete sensitive files. This allows an authenticated local attacker with administrative privileges to configure an unauthorized administrator account. Affected products include Firepower 4100/9300, Nexus 1000V, 1100, 2000, 3500, 4000, 5500, 5600, 6000 series, and UCS 6100/6200/6300 Fabric Interconnects, as detailed in Cisco Security Advisory cisco-sa-20180620-nxosadmin [1].

Exploitation

An attacker must have administrative access to the device. They log in as an administrative user and execute the write-erase CLI commands to clear the configuration and reload the device. During this process, the attacker can configure an unauthorized account that does not require a password and is accessible only via SSH. The account does not appear in the running configuration or audit logs, making it stealthy.

Impact

Successful exploitation allows the attacker to create a hidden account with full administrative privileges. This account has no password requirement and is not visible in configuration or logs, enabling persistent unauthorized access to the device via SSH. The attacker can then perform any administrative actions, compromising the confidentiality, integrity, and availability of the device.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to fixed versions as specified in the Cisco Security Advisory [1]. No workarounds are available. The advisory provides instructions for obtaining updates through Cisco TAC or the Cisco website. Affected devices should be updated promptly to prevent exploitation.