Summary

• A vulnerability in the CLI of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack.
  
  The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to execute arbitrary commands at the user's privilege level. On products that support multiple virtual device contexts (VDCs), this vulnerability could allow the attacker to execute commands at the user's privilege level outside the user's environment.
  
  There are no workarounds that address this vulnerability.
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-fxnx

Affected Products

• Vulnerable Products

  This vulnerability affects the following Cisco products running Cisco FXOS or NX-OS System Software:
  

  Vulnerable Product	Cisco Bug ID
  Firepower 4100 Series Next-Generation Firewall	CSCve93880
  Firepower 9300 Security Appliance	CSCve93880
  MDS 9000 Series Multilayer Switches	CSCve51700
  Nexus 1000V Series Switches	CSCve93864
  Nexus 3000 Series Switches	CSCve51700
  Nexus 3500 Platform Switches	CSCve93833
  Nexus 2000, 5000, 5500, 5600, and 6000 Series Switches	CSCve93863
  Nexus 7000 and 7700 Series Switches	CSCve51700
  Nexus 9000 Series Switches - Standalone, NX-OS mode	CSCve51700
  Nexus 9500 R-Series Line Cards and Fabric Modules	CSCve51700
  Unified Computing System Manager	CSCve93860

  
  For information about affected releases, consult the Cisco bug IDs listed in the preceding table and at the top of this advisory.

  Products Confirmed Not Vulnerable

  No other Cisco products are currently known to be affected by this vulnerability.
  
  Cisco has confirmed that this vulnerability does not affect the following products:
  

  • Firepower 2100 Series
  • Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode

Workarounds

• There are no workarounds that address this vulnerability.

Fixed Software

• For information about fixed software releases, consult the Cisco bug IDs at the top of this advisory.

  When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during internal security testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-fxnx

Revision History

• Version	Description	Section	Status	Date
  1.1	Added the table of affected products and the bug ID for each affected product.	Vulnerable Products	Final	2018-January-11
  1.0	Initial public release.	—	Final	2017-November-29

  Show Less