Sign-up

ID

VAR-201905-0242


CVE

CVE-2019-1728


TITLE

Cisco FXOS Software and Cisco NX-OS Vulnerabilities related to digital signature verification in software

Trust: 0.8

sources: JVNDB: JVNDB-2019-004598

DESCRIPTION

A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device. Cisco FXOS Software and Cisco NX-OS The software contains a vulnerability related to digital signature verification.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Cisco FXOS and NX-OS Software are prone to an local command-injection vulnerability. This issue is being tracked by Cisco Bug IDs CSCvh20223, CSCvi96577, CSCvi96578, CSCvi96579, CSCvi96580, CSCvi96583 and CSCvi96584. Cisco Firepower 4100 Series, etc. are all products of Cisco (Cisco). Cisco Firepower 4100 Series is a 4100 series firewall device. Cisco Nexus 3000 Series Switches is a 3000 series switch. Cisco Nexus 3500 Platform Switches is a 3500 series platform switch. The vulnerability stems from a network system or product not adequately verifying the origin or authenticity of data. Attackers can use forged data to attack. The following products and versions are affected: Cisco Firepower 4100 Series ; Firepower 9300 Security Appliances ; MDS 9000 Series Multilayer Switches ; Nexus 3000 Series Switches ; Nexus 3500 Platform Switches ; Nexus 3600 Platform Switches ; Nexus 5500 Platform Switches ; Nexus 5600 Platform Switches ; Nexus 6000 Series Switches; Nexus 7000 Series Switches; Nexus 7700 Series Switches; Nexus 9000 Series Switches in standalone NX-OS mode; Nexus 9500 R-Series Switching Platform; UCS 6200 Series Fabric Interconnects; UCS 6300 Series Fabric

Trust: 1.98

sources: NVD: CVE-2019-1728 // JVNDB: JVNDB-2019-004598 // BID: 108391 // VULHUB: VHN-149510

AFFECTED PRODUCTS

vendor:ciscomodel:nx-osscope:gteversion:8.0

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.3\(4\)n1\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.3

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.2

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:4.0\(1a\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:6.2\(22\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:8.3\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:4.0

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:8.1\(1b\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.3\(3\)d1\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)i7

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:6.0\(2\)a8\(11\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:6.0\(2\)a8

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:6.2

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:2.4

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)i7\(3\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:2.4.1.101

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:8.2

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:8.1

Trust: 1.0

vendor:ciscomodel:nx-osscope: - version: -

Trust: 0.8

vendor:ciscomodel:ucs series fabric interconnectsscope:eqversion:63000

Trust: 0.3

vendor:ciscomodel:ucs series fabric interconnectsscope:eqversion:62000

Trust: 0.3

vendor:ciscomodel:nx-os software for ucs series fabric interconnectsscope:eqversion:63004.0

Trust: 0.3

vendor:ciscomodel:nx-os software for ucs series fabric interconnectsscope:eqversion:62004.0

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus r-series switching platformscope:eqversion:95007.0(3)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:90009.2(1)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.0 i7scope:eqversion:9000

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77008.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77008.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77008.1

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77008.0

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77007.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77007.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:77006.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70008.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70008.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70008.1

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70008.0

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70007.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70007.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:70006.2

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:60007.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:56007.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:55007.3

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switchesscope:eqversion:36007.0(3)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switchesscope:eqversion:35007.0(3)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switches 6.0 a8scope:eqversion:3500

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:eqversion:30009.2(1)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.0 i7scope:eqversion:3000

Trust: 0.3

vendor:ciscomodel:nx-os software for mds series multilayer switchesscope:eqversion:90008.3

Trust: 0.3

vendor:ciscomodel:nx-os software for mds series multilayer switchesscope:eqversion:90008.2

Trust: 0.3

vendor:ciscomodel:nx-os software for mds series multilayer switchesscope:eqversion:90008.1

Trust: 0.3

vendor:ciscomodel:nexus r-series switching platformscope:eqversion:95000

Trust: 0.3

vendor:ciscomodel:nexus series switches in standalone nx-os modescope:eqversion:90000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:77000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:70000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:60000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:56000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:55000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:36000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:35000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:30000

Trust: 0.3

vendor:ciscomodel:mds series multilayer switchesscope:eqversion:90000

Trust: 0.3

vendor:ciscomodel:fxos software for firepower series appliancesscope:eqversion:93002.4

Trust: 0.3

vendor:ciscomodel:fxos software for firepower series appliancesscope:eqversion:41002.4

Trust: 0.3

vendor:ciscomodel:firepower security appliancesscope:eqversion:93000

Trust: 0.3

vendor:ciscomodel:firepower seriesscope:eqversion:41000

Trust: 0.3

vendor:ciscomodel:nx-os software for ucs series fabric interconnects 4.0scope:neversion:6300

Trust: 0.3

vendor:ciscomodel:nx-os software for ucs series fabric interconnects 4.0scope:neversion:6200

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus r-series switching platform 7.0 f3scope:neversion:9500

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.0 i7scope:neversion:9000

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:neversion:77008.3(1)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.3 d1scope:neversion:7700

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:neversion:77006.2(22)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:neversion:70008.3(1)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.3 d1scope:neversion:7000

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switchesscope:neversion:70006.2(22)

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.3 n1scope:neversion:6000

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.3 n1scope:neversion:5600

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.3 n1scope:neversion:5500

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switches 7.0 f3scope:neversion:3600

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switches 7.0 i7scope:neversion:3500

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus platform switches 6.0 a8scope:neversion:3500

Trust: 0.3

vendor:ciscomodel:nx-os software for nexus series switches 7.0 i7scope:neversion:3000

Trust: 0.3

vendor:ciscomodel:nx-os software for mds series multilayer switchesscope:neversion:90008.3(1)

Trust: 0.3

vendor:ciscomodel:nx-os software for mds series multilayer switches 8.1scope:neversion:9000

Trust: 0.3

vendor:ciscomodel:fxos software for firepower series appliancesscope:neversion:93002.4.1.101

Trust: 0.3

vendor:ciscomodel:fxos software for firepower series appliancesscope:neversion:41002.4.1.101

Trust: 0.3

sources: BID: 108391 // JVNDB: JVNDB-2019-004598 // NVD: CVE-2019-1728

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1728
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1728
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-1728
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201905-642
value: MEDIUM

Trust: 0.6

VULHUB: VHN-149510
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-1728
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-149510
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1728
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-149510 // JVNDB: JVNDB-2019-004598 // CNNVD: CNNVD-201905-642 // NVD: CVE-2019-1728 // NVD: CVE-2019-1728

PROBLEMTYPE DATA

problemtype:CWE-347

Trust: 1.9

sources: VULHUB: VHN-149510 // JVNDB: JVNDB-2019-004598 // NVD: CVE-2019-1728

THREAT TYPE

local

Trust: 0.9

sources: BID: 108391 // CNNVD: CNNVD-201905-642

TYPE

data forgery

Trust: 0.6

sources: CNNVD: CNNVD-201905-642

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004598

PATCH
title:cisco-sa-20190515-nxos-conf-bypassurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-conf-bypass
Trust: 0.8
title:Cisco NX-OS Software  and Cisco FXOS Software Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92768
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-004598 // 
            
            
            
            CNNVD: CNNVD-201905-642

EXTERNAL IDS
db:NVDid:CVE-2019-1728
Trust: 2.8
db:BIDid:108391
Trust: 2.0
db:JVNDBid:JVNDB-2019-004598
Trust: 0.8
db:CNNVDid:CNNVD-201905-642
Trust: 0.7
db:AUSCERTid:ESB-2019.1759.4
Trust: 0.6
db:AUSCERTid:ESB-2019.1759.3
Trust: 0.6
db:AUSCERTid:ESB-2019.1759.5
Trust: 0.6
db:VULHUBid:VHN-149510
Trust: 0.1
sources:
            
            
            VULHUB: VHN-149510 // 
            
            
            
            BID: 108391 // 
            
            
            
            JVNDB: JVNDB-2019-004598 // 
            
            
            
            CNNVD: CNNVD-201905-642 // 
            
            
            
            NVD: CVE-2019-1728

REFERENCES
url:http://www.securityfocus.com/bid/108391
Trust: 2.3
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-conf-bypass
Trust: 2.0
url:https://nvd.nist.gov/vuln/detail/cve-2019-1728
Trust: 1.4
url:http://www.cisco.com/
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1728
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-snmp-dos
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-info
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-cmdinj-1795
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1780
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1779
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.5/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.4/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.3/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/81118
Trust: 0.6
url:https://vigilance.fr/vulnerability/cisco-nx-os-code-execution-at-boot-time-29327
Trust: 0.6
sources:
            
            
            VULHUB: VHN-149510 // 
            
            
            
            BID: 108391 // 
            
            
            
            JVNDB: JVNDB-2019-004598 // 
            
            
            
            CNNVD: CNNVD-201905-642 // 
            
            
            
            NVD: CVE-2019-1728

CREDITS
Cisco.
Trust: 0.9
sources:
            
            
            BID: 108391 // 
            
            
            
            CNNVD: CNNVD-201905-642

SOURCES
db:VULHUBid:VHN-149510
db:BIDid:108391
db:JVNDBid:JVNDB-2019-004598
db:CNNVDid:CNNVD-201905-642
db:NVDid:CVE-2019-1728

LAST UPDATE DATE
2024-08-14T13:26:30.525000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-149510date:2019-05-21T00:00:00
db:BIDid:108391date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-004598date:2019-06-05T00:00:00
db:CNNVDid:CNNVD-201905-642date:2021-07-13T00:00:00
db:NVDid:CVE-2019-1728date:2019-05-21T13:29:00.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-149510date:2019-05-15T00:00:00
db:BIDid:108391date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-004598date:2019-06-05T00:00:00
db:CNNVDid:CNNVD-201905-642date:2019-05-15T00:00:00
db:NVDid:CVE-2019-1728date:2019-05-15T17:29:01.593