Command Injection Vulnerability in Cisco Nexus Series Switches
CVE-2017-6649

7.8HIGH

Key Information:

Vendor
Cisco
Status
Cisco Nexus Series Switches
Vendor
CVE Published:
22 May 2017

Summary

An insufficient input validation vulnerability exists in the CLI of Cisco NX-OS System Software for Nexus Series Switches. This flaw allows an authenticated local attacker to perform a command injection attack by injecting crafted command arguments into CLI commands. Successful exploitation could enable the attacker to read or write arbitrary files according to the user's privilege level, potentially compromising the system's integrity. This vulnerability affects versions 7.1 through 7.3 of the NX-OS software.

Affected Version(s)

Cisco Nexus Series Switches Cisco Nexus Series Switches

References

http://www.securitytracker.com/id/1038518
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/98531
vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.