Command Injection Vulnerability in Cisco NX-OS Software

CVE-2018-0306

Summary

A vulnerability in the CLI parser of Cisco NX-OS Software allows authenticated, local attackers to exploit insufficient input validation. By injecting malicious command arguments into a vulnerable CLI command, attackers can execute arbitrary commands with root privileges on affected devices. This vulnerability necessitates that any feature license is uploaded to the device but does not require active usage of the license. Affected products include various series of Cisco switches and fabric extenders, potentially exposing critical network infrastructure to unauthorized commands.

References