CVE-2019-1811
published 2019-05-15CVE-2019-1811: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level…
PriorityP430medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.27%
18.1th percentile
A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_nx-os_software | >= unspecified < 8.3(1) | 8.3(1) |
| cisco | nx-os | < 7.0\(3\)i7\(5\) | 7.0\(3\)i7\(5\) |
| cisco | nx-os | — | — |
| cisco | nx-os | >= 6.0\(2\) < 7.0\(3\)i7\(5\) | 7.0\(3\)i7\(5\) |
| cisco | nx-os | >= 7.0\(3\) < 7.0\(3\)f3\(5\) | 7.0\(3\)f3\(5\) |
| cisco | nx-os | >= 9.2 < 9.2\(2\) | 9.2\(2\) |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv3.06.7MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
vendor_cisco·2019-05-15·CVSS 6.7
CVE-2019-1811 [MEDIUM] CWE-347 Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
Multiple vulnerabilities in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device.
The vulnerabilities exist because software digital signatures are not properly verified during CLI command execution. An attacker could exploit these vulnerabilities to install an unsigned software image on an affected device.
Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the attacker to boot a malicious software image.
Cisco has released software
Cisco
Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
vendor_cisco·CVSS 3.0
CVE-2019-1811 Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
CVE-2019-1811: Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities
Multiple vulnerabilities in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerabilities exist because software digital signatures are not properly verified during CLI command execution. An attacker could exploit these vulnerabilities to install an unsigned software image on an affected device. Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif , a successful exploit could allow the attacker to boot a malicious software image. Cisco has re
GHSA
GHSA-qw5q-44p2-mfcm: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-le
ghsa_unreviewed·2022-05-24
CVE-2019-1811 [HIGH] CWE-347 GHSA-qw5q-44p2-mfcm: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-le
A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
No detection rules found.
No public exploits indexed.
2019-05-15
Published