CVE-2019-1615 : A vulnerability in the Image Signature Verification feature of Cisco NX-OS Softw

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability is due to improper verification of digital signatures for software images. An attacker could exploit this vulnerability by loading an unsigned software image on an affected device. A successful exploit could allow the attacker to boot a malicious software image. Note: The fix for this vulnerability requires a BIOS upgrade as part of the software upgrade. For additional information, see the Details section of this advisory. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I7(5). Nexus 9000 Series Fabric Switches in ACI Mode are affected running software versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5).

Published 2019-03-11 21:29:01

Updated 2019-10-09 23:47:31

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2019-1615

Cisco » Nx-os » Version: 7.0(3)i7(3)
cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(3\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 9432pq » Version: N/A
When used together with: Cisco » 9536pq » Version: N/A
When used together with: Cisco » 9636pq » Version: N/A
When used together with: Cisco » 9736pq » Version: N/A
When used together with: Cisco » N9k-x9432c-s » Version: N/A
When used together with: Cisco » N9k-x9464px » Version: N/A
When used together with: Cisco » N9k-x9464tx2 » Version: N/A
When used together with: Cisco » N9k-x9564px » Version: N/A
When used together with: Cisco » N9k-x9564tx » Version: N/A
When used together with: Cisco » N9k-x9636c-r » Version: N/A
When used together with: Cisco » N9k-x9636c-rx » Version: N/A
When used together with: Cisco » N9k-x97160yc-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-fx » Version: N/A
When used together with: Cisco » N9k-x9736c-ex » Version: N/A
When used together with: Cisco » N9k-x9736c-fx » Version: N/A
When used together with: Cisco » N9k-x9788tc-fx » Version: N/A
When used together with: Cisco » Nexus 92160yc-x » Version: N/A
When used together with: Cisco » Nexus 92300yc » Version: N/A
When used together with: Cisco » Nexus 92304qc » Version: N/A
When used together with: Cisco » Nexus 9236c » Version: N/A
When used together with: Cisco » Nexus 9272q » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 9316d-gx » Version: N/A
When used together with: Cisco » Nexus 93180lc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx » Version: N/A
When used together with: Cisco » Nexus 93240yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9332c » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2 » Version: N/A
When used together with: Cisco » Nexus 9348gc-fxp » Version: N/A
When used together with: Cisco » Nexus 93600cd-gx » Version: N/A
When used together with: Cisco » Nexus 9364c » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A
When used together with: Cisco » X9636q-r » Version: N/A
Cisco » Nx-os » Version: 12.3(0.97)
cpe:2.3:o:cisco:nx-os:12.3\(0.97\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 9432pq » Version: N/A
When used together with: Cisco » 9536pq » Version: N/A
When used together with: Cisco » 9636pq » Version: N/A
When used together with: Cisco » 9736pq » Version: N/A
When used together with: Cisco » N9k-x9432c-s » Version: N/A
When used together with: Cisco » N9k-x9464px » Version: N/A
When used together with: Cisco » N9k-x9464tx2 » Version: N/A
When used together with: Cisco » N9k-x9564px » Version: N/A
When used together with: Cisco » N9k-x9564tx » Version: N/A
When used together with: Cisco » N9k-x9636c-r » Version: N/A
When used together with: Cisco » N9k-x9636c-rx » Version: N/A
When used together with: Cisco » N9k-x97160yc-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-fx » Version: N/A
When used together with: Cisco » N9k-x9736c-ex » Version: N/A
When used together with: Cisco » N9k-x9736c-fx » Version: N/A
When used together with: Cisco » N9k-x9788tc-fx » Version: N/A
When used together with: Cisco » Nexus 92160yc-x » Version: N/A
When used together with: Cisco » Nexus 92300yc » Version: N/A
When used together with: Cisco » Nexus 92304qc » Version: N/A
When used together with: Cisco » Nexus 9236c » Version: N/A
When used together with: Cisco » Nexus 9272q » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 9316d-gx » Version: N/A
When used together with: Cisco » Nexus 93180lc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx » Version: N/A
When used together with: Cisco » Nexus 93240yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9332c » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2 » Version: N/A
When used together with: Cisco » Nexus 9348gc-fxp » Version: N/A
When used together with: Cisco » Nexus 93600cd-gx » Version: N/A
When used together with: Cisco » Nexus 9364c » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A
When used together with: Cisco » X9636q-r » Version: N/A
Cisco » Nx-os » Version: 9.2(1)
cpe:2.3:o:cisco:nx-os:9.2\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 9432pq » Version: N/A
When used together with: Cisco » 9536pq » Version: N/A
When used together with: Cisco » 9636pq » Version: N/A
When used together with: Cisco » 9736pq » Version: N/A
When used together with: Cisco » N9k-x9432c-s » Version: N/A
When used together with: Cisco » N9k-x9464px » Version: N/A
When used together with: Cisco » N9k-x9464tx2 » Version: N/A
When used together with: Cisco » N9k-x9564px » Version: N/A
When used together with: Cisco » N9k-x9564tx » Version: N/A
When used together with: Cisco » N9k-x9636c-r » Version: N/A
When used together with: Cisco » N9k-x9636c-rx » Version: N/A
When used together with: Cisco » N9k-x97160yc-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-ex » Version: N/A
When used together with: Cisco » N9k-x9732c-fx » Version: N/A
When used together with: Cisco » N9k-x9736c-ex » Version: N/A
When used together with: Cisco » N9k-x9736c-fx » Version: N/A
When used together with: Cisco » N9k-x9788tc-fx » Version: N/A
When used together with: Cisco » Nexus 92160yc-x » Version: N/A
When used together with: Cisco » Nexus 92300yc » Version: N/A
When used together with: Cisco » Nexus 92304qc » Version: N/A
When used together with: Cisco » Nexus 9236c » Version: N/A
When used together with: Cisco » Nexus 9272q » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 9316d-gx » Version: N/A
When used together with: Cisco » Nexus 93180lc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx » Version: N/A
When used together with: Cisco » Nexus 93240yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9332c » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2 » Version: N/A
When used together with: Cisco » Nexus 9348gc-fxp » Version: N/A
When used together with: Cisco » Nexus 93600cd-gx » Version: N/A
When used together with: Cisco » Nexus 9364c » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A
When used together with: Cisco » X9636q-r » Version: N/A
Cisco » Nx-os » Version: 7.0(3)i7(5)
cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(5\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » N3k-c31128pq-10ge » Version: N/A
When used together with: Cisco » N3k-c3132c-z » Version: N/A
When used together with: Cisco » N3k-c3164q-40ge » Version: N/A
When used together with: Cisco » N3k-c3264q » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-1615

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1615

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.7	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.7	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-1615

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2019-1615

http://www.securityfocus.com/bid/107397

Cisco NX-OS Software CVE-2019-1615 Local Security Bypass Vulnerability
Third Party Advisory;VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-sig-verif

Cisco NX-OS Software Image Signature Verification Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-1615

Products affected by CVE-2019-1615

Exploit prediction scoring system (EPSS) score for CVE-2019-1615

CVSS scores for CVE-2019-1615

CWE ids for CVE-2019-1615

References for CVE-2019-1615