CVEvulnerability

CVE-2019-12662

6.7 MEDIUM Published 2019-09-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.7 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
6.7 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-347

Description

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper signature verification during the installation of an Open Virtual Appliance (OVA) image. An authenticated, local attacker could exploit this vulnerability and load a malicious, unsigned OVA image on an affected device. A successful exploit could allow an attacker to perform code execution on a crafted software OVA image.

Affected configurations

• cisco ios xe 16.8.1 • cisco nx-os 8.1\(0.2\)s0 • cisco nx-os 8.1\(1\) • cisco nx-os 8.1\(1\)s5 • cisco nx-os 8.1\(0\)bd\(0.20\) • cisco nexus 3016 firmware • cisco nexus 3048 firmware • cisco nexus 3064 firmware • cisco nexus 3064-t firmware • cisco nexus 31108pc-v firmware • cisco nexus 31108tc-v firmware • cisco nexus 31128pq firmware • cisco nexus 3132c-z firmware • cisco nexus 3132q firmware • cisco nexus 3132q-v firmware • cisco nexus 3132q-xl firmware • cisco nexus 3164q firmware • cisco nexus 3172 firmware • cisco nexus 3172pq-xl firmware • cisco nexus 3172tq firmware • cisco nexus 3172tq-32t firmware • cisco nexus 3172tq-xl firmware • cisco nexus 3232c firmware • cisco nexus 3264c-e firmware • cisco nexus 3264q firmware • cisco nexus 3408-s firmware • cisco nexus 34180yc firmware • cisco nexus 34200yc-sm firmware • cisco nexus 3432d-s firmware • cisco nexus 3464c firmware • cisco nexus 3524 firmware • cisco nexus 3524-x firmware • cisco nexus 3524-xl firmware • cisco nexus 3548 firmware • cisco nexus 3548-x firmware • cisco nexus 3548-xl firmware • cisco nexus 5548p firmware • cisco nexus 5548up firmware • cisco nexus 5596t firmware • cisco nexus 5596up firmware • cisco nexus 56128p firmware • cisco nexus 5624q firmware • cisco nexus 5648q firmware • cisco nexus 5672up firmware • cisco nexus 5696q firmware • cisco nexus 6001 firmware • cisco nexus 6004 firmware • cisco nexus 7000 10-slot firmware • cisco nexus 7000 18-slot firmware • cisco nexus 7000 4-slot firmware • cisco nexus 7000 9-slot firmware • cisco nexus 7700 10-slot firmware • cisco nexus 7700 18-slot firmware • cisco nexus 7700 2-slot firmware • cisco nexus 7700 6-slot firmware

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References