Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability

Vulnerability

Cisco Enterprise NFV Infrastructure Software (NFVIS) contains a privilege escalation vulnerability (CVE-2019-1972) in its restricted CLI. The bug is due to insufficient restrictions during the execution of an affected CLI command, allowing an authenticated local attacker with valid administrator-level credentials to bypass intended security boundaries. This issue affects NFVIS releases 3.6.3 through 3.10.3 [1].

Exploitation

An attacker must have valid administrator-level credentials and local access to the NFVIS system. The exploitation involves leveraging the insufficient restrictions during the execution of the vulnerable CLI command to escalate privileges [1]. No user interaction is required beyond the authenticated session.

Impact

Successful exploitation allows the attacker to elevate privileges to root on the underlying operating system and execute arbitrary commands. This results in full compromise of the NFVIS host, including the ability to read, modify, or delete sensitive data, and disrupt network functions [1].

Mitigation

Cisco has released software updates to address this vulnerability; there are no workarounds. Customers should upgrade to a fixed NFVIS release as specified in the Cisco Security Advisory [1]. The vulnerability is not known to be listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.