CVE-2021-1583 — Improper Access Control in Cisco Nx-os System Software IN ACI Mode

CWE-284 — Improper Access ControlCWE-863 — Incorrect Authorization4 documents4 sources
Severity
4.4MEDIUMNVD
EPSS
0.2%
top 63.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Nx-os System Software IN ACI ModeCisco Nx-os
Timeline
PublishedAug 25
Latest updateMay 24

Description

A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker with Administrator privileges could exploit this vulnerability by executing a specific vulnerable command on an affected device. A successful exploit could allow the attacker to …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/nx-os14.2\(7f\)

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xmrj-c495-vfvx: A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructu↗2022-05-24
▶
CVEList
Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability↗2021-08-25
▶

📋Vendor Advisories

1
Cisco
Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability↗2021-08-25
▶
CVE-2021-1583 — Improper Access Control in Cisco | cvebase