Cisco NX-OS Software Bash Shell Privilege Escalation Vulnerability

Vulnerability

The Bash shell implementation for Cisco NX-OS Software contains a vulnerability in which incorrect permissions are set on a system executable. This flaw allows an authenticated, local attacker to escalate privileges. Affected products include Nexus 3000 Series Switches (versions prior to 7.0(3)I7(4)), Nexus 3500 Platform Switches (versions prior to 7.0(3)I7(4)), Nexus 3600 Platform Switches (versions prior to 7.0(3)F3(5)), Nexus 9000 Series Switches in Standalone NX-OS Mode (versions prior to 7.0(3)I7(4)), and Nexus 9500 R-Series Line Cards and Fabric Modules (versions prior to 7.0(3)F3(5)). [1]

Exploitation

An attacker must first authenticate to the device with valid user credentials. Once logged in, the attacker simply enters a crafted command at the Bash prompt. The vulnerability is triggered due to the incorrect file permissions of a system executable, allowing the command to execute with elevated privileges. No additional user interaction or complex sequence of steps is required beyond authenticating and issuing the command. [1]

Impact

Successful exploitation allows the attacker to escalate their privilege level from an authenticated user to the root superuser. This gives the attacker complete control over the affected Cisco NX-OS device, enabling full compromise of confidentiality, integrity, and availability. [1]

Mitigation

Cisco has released free software updates to address this vulnerability. Users should upgrade to the fixed versions: 7.0(3)I7(4) or later for Nexus 3000, 3500, and 9000 Series, and 7.0(3)F3(5) or later for Nexus 3600 and 9500 R-Series. Customers can contact Cisco TAC for assistance if they do not have a service contract. [1]