Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability

Vulnerability

An authenticated, local attacker can exploit insufficient signature validation in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) to install a malicious file during an upgrade. The vulnerability affects Cisco NFVIS releases 3.11.1 and earlier [1].

Exploitation

The attacker must have authenticated local access to the device and be able to provide a crafted upgrade file. The insufficient signature validation allows the attacker to bypass integrity checks and upload the malicious file as part of the upgrade process [1].

Impact

Successful exploitation allows the attacker to upload crafted code to the affected device, potentially leading to remote code execution with elevated privileges [1].

Mitigation

Cisco released fixed software in NFVIS release 4.0.1. There are no workarounds that address this vulnerability, but administrators can mitigate risk by manually verifying upgrade hashes against published hashes on the official Cisco website before upgrading [1].