Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1613)

Vulnerability

A command injection vulnerability exists in the CLI of Cisco NX-OS Software, affecting multiple product families including MDS 9000 Series Multilayer Switches, Nexus 3000, 3500, 3600, 7000, 7700, 9000 Series Switches, and Nexus 9500 R-Series Line Cards and Fabric Modules. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. Affected software versions include those prior to 6.2(27) and 8.2(3) for MDS 9000; before 7.0(3)I4(9) and 7.0(3)I7(6) for Nexus 3000 and 9000; before 6.0(2)A8(11) and 7.0(3)I7(6) for Nexus 3500; before 7.0(3)F3(5) for Nexus 3600 and 9500 R-Series; and before 6.2(22) and 8.2(3) for Nexus 7000 and 7700 [1].

Exploitation

An attacker must have valid administrator credentials to exploit this vulnerability. The attacker includes malicious input as the argument of an affected CLI command, leading to injection of operating system commands [1]. No user interaction beyond authentication is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. This grants the attacker full control over the device, enabling disclosure of sensitive data, modification of configurations, or denial of service [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Administrators should upgrade to fixed releases as specified in the Cisco Security Advisory [1]. No workarounds are mentioned for this vulnerability.