Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1612)

Vulnerability

A command injection vulnerability exists in the CLI of Cisco NX-OS Software. The issue is due to insufficient validation of arguments passed to certain CLI commands. An authenticated, local attacker with administrator credentials can exploit this by including malicious input as the argument of an affected command. Affected products include Nexus 3000 Series (prior to 7.0(3)I4(9) and 7.0(3)I7(4)), Nexus 3500 Platform (prior to 7.0(3)I7(4)), Nexus 3600 Platform (prior to 7.0(3)F3(5)), and Nexus 9000 Series in Standalone mode (prior to 7.0(3)F3(5)). [1]

Exploitation

An attacker must have valid administrator credentials to access the CLI of an affected device. The attacker then issues a vulnerable CLI command with crafted input as an argument. The lack of proper input validation allows the injected commands to be executed on the underlying operating system. No user interaction beyond the attacker's own actions is required. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. This can lead to full compromise of the device, including disclosure of sensitive information, modification of configuration, or denial of service. The attacker gains root-level access. [1]

Mitigation

Cisco has released free software updates to address this vulnerability. Fixed versions include 7.0(3)I4(9) and 7.0(3)I7(4) for Nexus 3000, 7.0(3)I7(4) for Nexus 3500, and 7.0(3)F3(5) for Nexus 3600 and Nexus 9000 Standalone. Customers should upgrade to the appropriate fixed release. No workarounds are mentioned in the advisory. [1]