Cisco NX-OS Software NX-API Command Injection Vulnerability

Vulnerability

A command injection vulnerability exists in the NX-API subsystem of Cisco NX-OS Software [1]. The issue stems from insufficient input validation of user-supplied data processed by the NX-API feature. An authenticated, remote attacker can exploit this flaw by sending crafted HTTP or HTTPS packets to the management interface of an affected device [1]. NX-API is disabled by default, so exploitation is only possible on systems where it has been explicitly enabled. The following products and versions are affected: MDS 9000 Series Multilayer Switches prior to 8.1(1b) and 8.2(3), Nexus 3000 Series prior to 7.0(3)I4(9) and 7.0(3)I7(4), Nexus 3500 Platform prior to 7.0(3)I7(4), Nexus 2000/5500/5600/6000 Series prior to 7.3(4)N1(1), Nexus 9000 Series in Standalone NX-OS Mode prior to 7.0(3)I4(9) and 7.0(3)I7(4), and Nexus 7000/7700 Series prior to 7.3(3)D1(1) and 8.2(3) [1].

Exploitation

An attacker must have valid credentials to authenticate to the affected device, and the NX-API feature must be enabled on the management interface [1]. The attack does not require any additional privileges or user interaction beyond authentication. The attacker sends specially crafted HTTP or HTTPS requests to the NX-API endpoint, which triggers the command injection due to improper input validation [1].

Impact

A successful exploit allows the attacker to execute arbitrary operating system commands with root privileges on the affected device [1]. This results in complete compromise of the system's confidentiality, integrity, and availability, as the attacker gains full control over the switch or switch family.

Mitigation

Cisco has released free software updates to address this vulnerability [1]. The advisory provides specific version recommendations for each affected product line (e.g., MDS 9000 Series upgrade to 8.1(1b) or 8.2(3); Nexus 3000 Series upgrade to 7.0(3)I4(9) or 7.0(3)I7(4); see full list in the Vulnerability section) [1]. Users are advised to upgrade to the appropriate fixed version. As a workaround, administrators can disable the NX-API feature if it is not required for operations [1].