| Vulnerability Name: | CVE-2019-1601 (CCN-157842) |
| Assigned: | 2018-12-06 |
| Published: | 2019-03-06 |
| Updated: | 2020-10-08 |
| Summary: | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical configuration file. The vulnerability is due to a failure to impose strict filesystem permissions on the targeted device. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow an attacker to use the content of this configuration file to bypass authentication and log in as any user of the device. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25), 8.1(1b), and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
|
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
|
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
|
| Vulnerability Type: | CWE-732
|
| Vulnerability Consequences: | Bypass Security |
| References: | Source: MITRE
Type: CNA
CVE-2019-1601
Source: BID
Type: Third Party Advisory, VDB Entry
107404
Source: XF
Type: UNKNOWN
cisco-cve20191601-sec-bypass(157842)
Source: CCN
Type: Cisco Security Advisory cisco-sa-20190306-nxos-file-access
Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability
Source: CISCO
Type: Patch, Vendor Advisory
20190306 Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 8.2 and < 8.3(1))AND cpe:/h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 2:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.0(3) and < 7.0(3)i7(4))AND cpe:/h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 3:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.0(3)i5 and < 7.0(3)i7(4))AND cpe:/h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 4:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.0(3)f3 and < 7.0(3)f3(5))AND cpe:/h:cisco:nexus_3600:-:*:*:*:*:*:*:*
Configuration 5:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.0(3)i5 and < 7.0(3)i7(4))AND cpe:/h:cisco:nexus_9000:-:*:*:*:*:*:*:*
Configuration 6:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.0(3)f1 and < 7.0(3)f3(5))AND cpe:/h:cisco:nexus_9500:-:*:*:*:*:*:*:*
Configuration 7:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.3 and < 8.1(1b))AND cpe:/h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 8:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 6.2(25))AND cpe:/h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 9:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 7.0(3)i4(9))AND cpe:/h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 10:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 8.2 and < 8.3(1))AND cpe:/h:cisco:nexus_7000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 11:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.2 and < 7.3(3)d1(1))AND cpe:/h:cisco:nexus_7000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 12:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 6.2(22))AND cpe:/h:cisco:nexus_7000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 13:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 7.0(3)i4(9))AND cpe:/h:cisco:nexus_9000:-:*:*:*:*:*:*:*
Configuration 14:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 6.0(2)a8(10))AND cpe:/h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 15:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 7.2 and < 7.3(3)n1(1))AND cpe:/h:cisco:nexus_2000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_5500:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_5600:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 16:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version < 7.1(5)n1(1b))AND cpe:/h:cisco:nexus_2000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_5500:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_5600:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 17:
cpe:/o:cisco:nx-os:*:*:*:*:*:*:*:* (Version >= 8.0 and < 8.1(2))AND cpe:/h:cisco:nexus_7000:-:*:*:*:*:*:*:*OR cpe:/h:cisco:nexus_7700:-:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |