CVEvulnerability

CVE-2019-1732

6.4 MEDIUM Published 2019-05-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-05-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
6.4 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-667, CWE-78

Description

A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.

Affected configurations

• cisco nx-os (>= 7.0\(3\)i4 < 7.0\(3\)i7\(4\)) • cisco nx os (>= 7.0\(3\) < 7.0\(3\)f3\(5\))

Related

Weakness · CWE (2)

  • CWE-667 Improper Locking weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References