Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1608)

Vulnerability

A command injection vulnerability exists in the CLI of Cisco NX-OS Software, affecting MDS 9000 Series Multilayer Switches prior to versions 6.2(27), 8.1(1b), and 8.3(1), and Nexus 7000 and 7700 Series Switches prior to versions 6.2(22), 7.3(3)D1(1), and 8.2(3) [1]. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands [1]. An attacker must have valid administrator credentials to reach the affected code path [1].

Exploitation

An authenticated, local attacker with administrator privileges can exploit the vulnerability by providing malicious input as the argument of an affected CLI command [1]. No user interaction beyond the attacker's own actions is required. The attacker must be able to access the device CLI, which is typical for an already-authenticated administrator [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with elevated privileges, enabling complete compromise of the device's confidentiality, integrity, and availability [1]. The attacker gains full control over the affected switch [1].

Mitigation

Cisco has released free software updates to address this vulnerability [1]. The fixed versions are 6.2(27), 8.1(1b), and 8.3(1) for MDS 9000 Series, and 6.2(22), 7.3(3)D1(1), and 8.2(3) for Nexus 7000 and 7700 Series [1]. Customers should upgrade to a fixed release. No workarounds are mentioned in the available reference [1].