Bash Shell Access Vulnerability in Cisco NX-OS System Software on MDS and Nexus Switches

CVE-2017-12340

Summary

A vulnerability in Cisco NX-OS System Software affects Cisco MDS Multilayer Director Switches and Nexus 7000 and 7700 Series Switches. It allows an authenticated local attacker to access the Bash shell of the device's operating system, even when Bash shell access is disabled. This issue arises from inadequate sanitization of user-supplied parameters in the Python scripting sandbox, enabling an attacker to escape the sandbox environment. To exploit this vulnerability, an attacker must have local and authenticated access to the system, possessing either administrative rights or privileges to execute Python scripts. For more details, refer to Cisco's security advisory.

References