CVE-2019-1727 — OS Command Injection in Cisco Nx-os Software

CWE-264CWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUMNVD
EPSS
0.1%
top 66.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Nx-os SoftwareCisco Nx-os
Timeline
PublishedMay 15
Latest updateMay 24

Description

A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary command…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco/cisco_nx-os_softwareunspecified — 6.2(25)+3
▶NVDcisco/nx-os5.2 — 8.1\(1b\)+6

🔴Vulnerability Details

2
GHSA
GHSA-h9j3-p28g-73q9: A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and↗2022-05-24
▶
CVEList
Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability↗2019-05-15
▶

📋Vendor Advisories

1
Cisco
Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability↗2019-05-15
▶
CVE-2019-1727 — OS Command Injection in Cisco | cvebase