Vulnerabilities > CVE-2019-1585 - Configuration vulnerability in Cisco products

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

cisco

CWE-16

NVD

Published: 2019-03-06

Updated: 2019-10-09

Summary

A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco NX OS 8.3\(0\)Sk\(0.39\) Cisco Application Policy Infrastructure Controller Software *	2
Hardware	Cisco Cisco Nexus 92160Yc X - Cisco Nexus 92304Qc - Cisco Nexus 9236C - Cisco Nexus 9272Q - Cisco Nexus 93108Tc EX - Cisco Nexus 93120Tx - Cisco Nexus 93128Tx - Cisco Nexus 93180Yc EX - Cisco Nexus 9332Pq - Cisco Nexus 9336Pq ACI Spine - Cisco Nexus 9372Px - Cisco Nexus 9372Tx - Cisco Nexus 9396Px - Cisco Nexus 9396Tx - Cisco Nexus 9500 - Cisco Nexus 9504 - Cisco Nexus 9508 - Cisco Nexus 9516 -	18

Common Weakness Enumeration (CWE)

CWE-16 - Configuration

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References