Command Injection Vulnerability in Cisco NX-OS Software for Network Switches

CVE-2018-0313

What is CVE-2018-0313?

A command injection vulnerability exists in the NX-API feature of Cisco's NX-OS Software, allowing an authenticated remote attacker to send a crafted packet to the management interface of affected systems. The flaw arises from inadequate input validation in the NX-API subsystem. An attacker can leverage this vulnerability by dispatching a malicious HTTP or HTTPS packet, potentially gaining the ability to execute arbitrary commands with root privileges. While NX-API is disabled by default, systems with it enabled are at risk, affecting various Cisco switch models.

References