Unauthorized Access Vulnerability in Cisco FXOS and NX-OS Software
CVE-2018-0294

6.7MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Fxos And Nx-os Unknown
Vendor
CVE Published:
20 June 2018

Summary

A vulnerability exists in the write-erase functionality of Cisco FXOS Software and NX-OS Software, allowing authenticated local attackers to create unauthorized administrative accounts. This security flaw arises from improper deletion of sensitive files, particularly when specific CLI commands are executed for clearing device configurations and reloading the system. Attackers exploiting this vulnerability can gain access through SSH without needing a password, leading to potential unauthorized control over crucial system operations, all while remaining undetected in the running configuration or audit logs.

Affected Version(s)

Cisco FXOS and NX-OS unknown Cisco FXOS and NX-OS unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1041169
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.