CVE-2023-20050

EPSS 0.06%
Published 23.02.2023 20:15:13
Last modified 21.11.2024 07:40:26
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Nx-os Version-

   Cisco ≫ Mds 9000 Version-
   Cisco ≫ Mds 9100 Version-
   Cisco ≫ Mds 9132t Version-
   Cisco ≫ Mds 9134 Version-
   Cisco ≫ Mds 9140 Version-
   Cisco ≫ Mds 9148 Version-
   Cisco ≫ Mds 9148s Version-
   Cisco ≫ Mds 9148t Version-
   Cisco ≫ Mds 9200 Version-
   Cisco ≫ Mds 9216 Version-
   Cisco ≫ Mds 9216a Version-
   Cisco ≫ Mds 9216i Version-
   Cisco ≫ Mds 9222i Version-
   Cisco ≫ Mds 9250i Version-
   Cisco ≫ Mds 9396s Version-
   Cisco ≫ Mds 9396t Version-
   Cisco ≫ Mds 9500 Version-
   Cisco ≫ Mds 9506 Version-
   Cisco ≫ Mds 9509 Version-
   Cisco ≫ Mds 9513 Version-
   Cisco ≫ Mds 9700 Version-
   Cisco ≫ Mds 9706 Version-
   Cisco ≫ Mds 9710 Version-
   Cisco ≫ Mds 9718 Version-
   Cisco ≫ Nexus 1000 Virtual Edge Version- SwPlatformvmware_vsphere
   Cisco ≫ Nexus 1000v Version- SwPlatformhyper-v
   Cisco ≫ Nexus 1000v Version- SwPlatformmicrosoft_hyper-v
   Cisco ≫ Nexus 5500 Version-
   Cisco ≫ Nexus 5548p Version-
   Cisco ≫ Nexus 5548up Version-
   Cisco ≫ Nexus 5596t Version-
   Cisco ≫ Nexus 5596up Version-
   Cisco ≫ Nexus 5600 Version-
   Cisco ≫ Nexus 56128p Version-
   Cisco ≫ Nexus 5624q Version-
   Cisco ≫ Nexus 5648q Version-
   Cisco ≫ Nexus 5672up Version-
   Cisco ≫ Nexus 5672up-16g Version-
   Cisco ≫ Nexus 5696q Version-
   Cisco ≫ Nexus 6000 Version-
   Cisco ≫ Nexus 6001 Version-
   Cisco ≫ Nexus 6001p Version-
   Cisco ≫ Nexus 6001t Version-
   Cisco ≫ Nexus 6004 Version-
   Cisco ≫ Nexus 6004x Version-

Cisco ≫ Nx-os Version < 8.2\(9\)

   Cisco ≫ Nexus 7000 Version-
   Cisco ≫ Nexus 7004 Version-
   Cisco ≫ Nexus 7009 Version-
   Cisco ≫ Nexus 7010 Version-
   Cisco ≫ Nexus 7018 Version-
   Cisco ≫ Nexus 7700 Version-
   Cisco ≫ Nexus 7702 Version-
   Cisco ≫ Nexus 7706 Version-
   Cisco ≫ Nexus 7710 Version-
   Cisco ≫ Nexus 7718 Version-

Cisco ≫ Nx-os Version < 9.3\(10\)

   Cisco ≫ Nexus 3016 Version-
   Cisco ≫ Nexus 3016q Version-
   Cisco ≫ Nexus 3048 Version-
   Cisco ≫ Nexus 3064 Version-
   Cisco ≫ Nexus 3064-32t Version-
   Cisco ≫ Nexus 3064-t Version-
   Cisco ≫ Nexus 3064-x Version-
   Cisco ≫ Nexus 3064t Version-
   Cisco ≫ Nexus 3064x Version-
   Cisco ≫ Nexus 3100 Version-
   Cisco ≫ Nexus 3100-v Version-
   Cisco ≫ Nexus 3100-z Version-
   Cisco ≫ Nexus 3100v Version-
   Cisco ≫ Nexus 31108pc-v Version-
   Cisco ≫ Nexus 31108pv-v Version-
   Cisco ≫ Nexus 31108tc-v Version-
   Cisco ≫ Nexus 31128pq Version-
   Cisco ≫ Nexus 3132c-z Version-
   Cisco ≫ Nexus 3132q Version-
   Cisco ≫ Nexus 3132q-v Version-
   Cisco ≫ Nexus 3132q-x Version-
   Cisco ≫ Nexus 3132q-x/3132q-xl Version-
   Cisco ≫ Nexus 3132q-xl Version-
   Cisco ≫ Nexus 3164q Version-
   Cisco ≫ Nexus 3172 Version-
   Cisco ≫ Nexus 3172pq Version-
   Cisco ≫ Nexus 3172pq-xl Version-
   Cisco ≫ Nexus 3172pq/pq-xl Version-
   Cisco ≫ Nexus 3172tq Version-
   Cisco ≫ Nexus 3172tq-32t Version-
   Cisco ≫ Nexus 3172tq-xl Version-
   Cisco ≫ Nexus 3200 Version-
   Cisco ≫ Nexus 3232c Version-
   Cisco ≫ Nexus 3232c Version-
   Cisco ≫ Nexus 3264c-e Version-
   Cisco ≫ Nexus 3264q Version-
   Cisco ≫ Nexus 3400 Version-
   Cisco ≫ Nexus 3408-s Version-
   Cisco ≫ Nexus 34180yc Version-
   Cisco ≫ Nexus 34200yc-sm Version-
   Cisco ≫ Nexus 3432d-s Version-
   Cisco ≫ Nexus 3464c Version-
   Cisco ≫ Nexus 3500 Version-
   Cisco ≫ Nexus 3524 Version-
   Cisco ≫ Nexus 3524-x Version-
   Cisco ≫ Nexus 3524-x/xl Version-
   Cisco ≫ Nexus 3524-xl Version-
   Cisco ≫ Nexus 3548 Version-
   Cisco ≫ Nexus 3548-x Version-
   Cisco ≫ Nexus 3548-x/xl Version-
   Cisco ≫ Nexus 3548-xl Version-
   Cisco ≫ Nexus 3600 Version-
   Cisco ≫ Nexus 36180yc-r Version-
   Cisco ≫ Nexus 3636c-r Version-
   Cisco ≫ Nexus 9000 Version-
   Cisco ≫ Nexus 9000v Version-

Cisco ≫ Nx-os Version < 10.2\(4\)

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.06%	0.205

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
psirt@cisco.com	4.4	1.8	2.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cli-cmdinject-euQVK9u

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-20050

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-20050

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-20050

EUVD