Cisco Nexus 9000 Series Fabric Switches CVE-2019-1591 Local Command Injection Vulnerability

Bugtraq ID:	107311
Class:	Input Validation Error
CVE:	CVE-2019-1591
Remote:	No
Local:	Yes
Published:	Mar 06 2019 12:00AM
Updated:	Mar 06 2019 12:00AM
Credit:	Nicolas Biscos and Gaetan Ferry from Synacktiv
Vulnerable:	Cisco Nexus 9000 Series ACI Mode Switches 11.1(1j) Cisco Nexus 9000 Series ACI Mode Switches 11.0(4o) Cisco Nexus 9000 Series ACI Mode Switches 11.0(3n) Cisco Nexus 9000 Series ACI Mode Switches 11.0(3h) Cisco Nexus 9000 Series ACI Mode Switches 11.0(2m) Cisco Nexus 9000 Series ACI Mode Switches 11.0(1c) Cisco Nexus 9000 Series ACI Mode Switches 11.0
Not Vulnerable:	Cisco Nexus 9000 Series ACI Mode Switches 14.0(3d)

Cisco Nexus 9000 Series Fabric Switches CVE-2019-1591 Local Command Injection Vulnerability

Cisco Nexus 9000 Series Fabric Switches are prone to an local command-injection vulnerability.

An attacker may exploit this issue to inject and execute arbitrary commands with root-level privileges; this may aid in further attacks.

This issue being tracked by Cisco Bug ID CSCvm52063.

Versions prior to Cisco Nexus 9000 Series ACI Mode Switches 14.0(3d) are vulnerable.