CVE-2017-6649 : A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could a

A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86787, CSCve60516, CSCve60555.

Published 2017-05-22 01:29:01

Updated 2019-10-03 00:03:26

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Exploit prediction scoring system (EPSS) score for CVE-2017-6649

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-6649

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-6649

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by:

nvd@nist.gov (Primary)
ykramarz@cisco.com (Secondary)

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-6649

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss

Cisco Nexus Series Switches CLI Command Injection Vulnerability
Vendor Advisory
http://www.securitytracker.com/id/1038518

Cisco Nexus 5000 Series Switches Input Validation Flaw Lets Local Users Read and Write Files on the Target System - SecurityTracker

CVEs referencing this url
http://www.securityfocus.com/bid/98531

Multiple Cisco Products CVE-2017-6649 Local Command Injection Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2017-6649

Cisco » Nx-os » Version: 7.2(0)zz(99.1)
cpe:2.3:o:cisco:nx-os:7.2\(0\)zz\(99.1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.2(1)n1(1)
cpe:2.3:o:cisco:nx-os:7.2\(1\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.2(0)n1(1)
cpe:2.3:o:cisco:nx-os:7.2\(0\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(1)n1(1)
cpe:2.3:o:cisco:nx-os:7.1\(1\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(3)n1(1)
cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(2)n1(1)
cpe:2.3:o:cisco:nx-os:7.1\(2\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.2(0)d1(0.437)
cpe:2.3:o:cisco:nx-os:7.2\(0\)d1\(0.437\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(3)n1(3.12)
cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(3.12\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(3)n1(2.1)
cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(2.1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(3)n1(2)
cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(2\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.1(4)n1(1)
cpe:2.3:o:cisco:nx-os:7.1\(4\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
Cisco » Nx-os » Version: 7.3(0)n1(1)
cpe:2.3:o:cisco:nx-os:7.3\(0\)n1\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A

Vulnerability Details : CVE-2017-6649

Exploit prediction scoring system (EPSS) score for CVE-2017-6649

CVSS scores for CVE-2017-6649

CWE ids for CVE-2017-6649

References for CVE-2017-6649

Products affected by CVE-2017-6649