Sign-up

ID

VAR-201806-0992


CVE

CVE-2018-0307


TITLE

Cisco NX-OS Software input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-006895

DESCRIPTION

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker, authenticated as a privileged user, to execute arbitrary commands with root privileges. Note: On products that support multiple virtual device contexts (VDC), this vulnerability could allow an attacker to access files from any VDC. This vulnerability affects Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 3600 Platform Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCve51704, CSCve91749, CSCve91768. Vendors have confirmed this vulnerability Bug ID CSCve51704 , CSCve91749 , CSCve91768 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. are products of Cisco. The Nexus3000 SeriesSwitches is a switch device. FabricModules is a switch matrix module. NX-OSSoftware is the data center-level operating system software used by a set of switches running on it. The CLI is one of the command line tools

Trust: 2.25

sources: NVD: CVE-2018-0307 // JVNDB: JVNDB-2018-006895 // CNVD: CNVD-2018-12385 // VULHUB: VHN-118509

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-12385

AFFECTED PRODUCTS

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)i3

Trust: 1.0

vendor:ciscomodel:nx-osscope:eqversion:7.0

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)i4

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.3\(3\)n1\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:6.2

Trust: 1.0

vendor:ciscomodel:nx-osscope:eqversion:8.2

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)i7\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:6.0

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:8.1\(2\)

Trust: 1.0

vendor:ciscomodel:nx-osscope: - version: -

Trust: 0.8

vendor:ciscomodel:nexus series switchescope:eqversion:3000

Trust: 0.6

vendor:ciscomodel:nexus series switchesscope:eqversion:7000

Trust: 0.6

vendor:ciscomodel:nexus series switchesscope:eqversion:6000

Trust: 0.6

vendor:ciscomodel:nexus series switchesscope:eqversion:7700

Trust: 0.6

vendor:ciscomodel:nexus platform switchesscope:eqversion:5600

Trust: 0.6

vendor:ciscomodel:nexus platform switchesscope:eqversion:5500

Trust: 0.6

vendor:ciscomodel:nexus series fabric extendersscope:eqversion:2000

Trust: 0.6

vendor:ciscomodel:nexus platform switchesscope:eqversion:3500

Trust: 0.6

vendor:ciscomodel:nexus r-series line cards and fabric modulesscope:eqversion:9500

Trust: 0.6

vendor:ciscomodel:nexus platform switchesscope:eqversion:3600

Trust: 0.6

vendor:ciscomodel:nexus series switchesscope:eqversion:9000

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.1\(2\)i2\(3\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(7\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(10\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.1\(2\)i3\(1\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(8b\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(11b\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(12\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.1\(2\)i3\(2\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(8\)

Trust: 0.6

vendor:ciscomodel:nx-osscope:eqversion:6.2\(8a\)

Trust: 0.6

sources: CNVD: CNVD-2018-12385 // JVNDB: JVNDB-2018-006895 // CNNVD: CNNVD-201806-1049 // NVD: CVE-2018-0307

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0307
value: HIGH

Trust: 1.0

NVD: CVE-2018-0307
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-12385
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201806-1049
value: HIGH

Trust: 0.6

VULHUB: VHN-118509
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-0307
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-12385
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-118509
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0307
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-0307
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-12385 // VULHUB: VHN-118509 // JVNDB: JVNDB-2018-006895 // CNNVD: CNNVD-201806-1049 // NVD: CVE-2018-0307

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-78

Trust: 1.1

sources: VULHUB: VHN-118509 // JVNDB: JVNDB-2018-006895 // NVD: CVE-2018-0307

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201806-1049

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201806-1049

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-006895

PATCH
title:cisco-sa-20180620-nx-os-cli-injectionurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nx-os-cli-injection
Trust: 0.8
title:Patches for various Cisco products NX-OSSoftwareCLI input verification vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/133279
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-12385 // 
            
            
            
            JVNDB: JVNDB-2018-006895

EXTERNAL IDS
db:NVDid:CVE-2018-0307
Trust: 3.1
db:SECTRACKid:1041169
Trust: 1.7
db:JVNDBid:JVNDB-2018-006895
Trust: 0.8
db:CNVDid:CNVD-2018-12385
Trust: 0.6
db:CNNVDid:CNNVD-201806-1049
Trust: 0.6
db:VULHUBid:VHN-118509
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-12385 // 
            
            
            
            VULHUB: VHN-118509 // 
            
            
            
            JVNDB: JVNDB-2018-006895 // 
            
            
            
            CNNVD: CNNVD-201806-1049 // 
            
            
            
            NVD: CVE-2018-0307

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180620-nx-os-cli-injection
Trust: 2.3
url:http://www.securitytracker.com/id/1041169
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0307
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0307
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2018-12385 // 
            
            
            
            VULHUB: VHN-118509 // 
            
            
            
            JVNDB: JVNDB-2018-006895 // 
            
            
            
            CNNVD: CNNVD-201806-1049 // 
            
            
            
            NVD: CVE-2018-0307

SOURCES
db:CNVDid:CNVD-2018-12385
db:VULHUBid:VHN-118509
db:JVNDBid:JVNDB-2018-006895
db:CNNVDid:CNNVD-201806-1049
db:NVDid:CVE-2018-0307

LAST UPDATE DATE
2024-11-23T21:38:49.139000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-12385date:2018-06-30T00:00:00
db:VULHUBid:VHN-118509date:2020-09-04T00:00:00
db:JVNDBid:JVNDB-2018-006895date:2018-09-04T00:00:00
db:CNNVDid:CNNVD-201806-1049date:2020-09-07T00:00:00
db:NVDid:CVE-2018-0307date:2024-11-21T03:37:56.687

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-12385date:2018-06-30T00:00:00
db:VULHUBid:VHN-118509date:2018-06-20T00:00:00
db:JVNDBid:JVNDB-2018-006895date:2018-09-04T00:00:00
db:CNNVDid:CNNVD-201806-1049date:2018-06-21T00:00:00
db:NVDid:CVE-2018-0307date:2018-06-20T21:29:00.577