Vulnerability Details : CVE-2019-1809

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.

Published 2019-05-15 23:29:01

Updated 2023-03-24 17:46:28

Source Cisco Systems, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-1809

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-1809

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	[email protected]
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.4	MEDIUM	CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	0.5	5.9	[email protected]
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	[email protected]
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-1809

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Assigned by:
- [email protected] (Primary)
- [email protected] (Secondary)

References for CVE-2019-1809

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb

Vendor Advisory
http://www.securityfocus.com/bid/108375

Broken Link;Third Party Advisory;VDB Entry

Products affected by CVE-2019-1809

Cisco » Nx-os
Versions from including (>=) 7.2 and before (<) 7.3\(3\)d1\(1\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 7000 10-slot » Version: N/A
When used together with: Cisco » 7000 18-slot » Version: N/A
When used together with: Cisco » 7000 4-slot » Version: N/A
When used together with: Cisco » 7000 9-slot » Version: N/A
When used together with: Cisco » 7700 10-slot » Version: N/A
When used together with: Cisco » 7700 18-slot » Version: N/A
When used together with: Cisco » 7700 2-slot » Version: N/A
When used together with: Cisco » 7700 6-slot » Version: N/A
When used together with: Cisco » N77-f312ck-26 » Version: N/A
When used together with: Cisco » N77-f324fq-25 » Version: N/A
When used together with: Cisco » N77-f348xp-23 » Version: N/A
When used together with: Cisco » N77-f430cq-36 » Version: N/A
When used together with: Cisco » N77-m312cq-26l » Version: N/A
When used together with: Cisco » N77-m324fq-25l » Version: N/A
When used together with: Cisco » N77-m348xp-23l » Version: N/A
When used together with: Cisco » N7k-f248xp-25e » Version: N/A
When used together with: Cisco » N7k-f306ck-25 » Version: N/A
When used together with: Cisco » N7k-f312fq-25 » Version: N/A
When used together with: Cisco » N7k-m202cf-22l » Version: N/A
When used together with: Cisco » N7k-m206fq-23l » Version: N/A
When used together with: Cisco » N7k-m224xp-23l » Version: N/A
When used together with: Cisco » N7k-m324fq-25l » Version: N/A
When used together with: Cisco » N7k-m348xp-25l » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 1 » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 2 » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 2e » Version: N/A
When used together with: Cisco » Nexus 7700 Supervisor 2e » Version: N/A
When used together with: Cisco » Nexus 7700 Supervisor 3e » Version: N/A
Cisco » Nx-os
Versions from including (>=) 3.1 and before (<) 3.2\(3k\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ucs 6248up » Version: N/A
When used together with: Cisco » Ucs 6296up » Version: N/A
When used together with: Cisco » Ucs 6324 » Version: N/A
When used together with: Cisco » Ucs 6332 » Version: N/A
When used together with: Cisco » Ucs 6332-16up » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.3 and before (<) 8.1\(1a\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9706 » Version: N/A
When used together with: Cisco » Mds 9710 » Version: N/A
When used together with: Cisco » Mds 9718 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 8.0 and before (<) 8.2\(3\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 7000 10-slot » Version: N/A
When used together with: Cisco » 7000 18-slot » Version: N/A
When used together with: Cisco » 7000 4-slot » Version: N/A
When used together with: Cisco » 7000 9-slot » Version: N/A
When used together with: Cisco » 7700 10-slot » Version: N/A
When used together with: Cisco » 7700 18-slot » Version: N/A
When used together with: Cisco » 7700 2-slot » Version: N/A
When used together with: Cisco » 7700 6-slot » Version: N/A
When used together with: Cisco » N77-f312ck-26 » Version: N/A
When used together with: Cisco » N77-f324fq-25 » Version: N/A
When used together with: Cisco » N77-f348xp-23 » Version: N/A
When used together with: Cisco » N77-f430cq-36 » Version: N/A
When used together with: Cisco » N77-m312cq-26l » Version: N/A
When used together with: Cisco » N77-m324fq-25l » Version: N/A
When used together with: Cisco » N77-m348xp-23l » Version: N/A
When used together with: Cisco » N7k-f248xp-25e » Version: N/A
When used together with: Cisco » N7k-f306ck-25 » Version: N/A
When used together with: Cisco » N7k-f312fq-25 » Version: N/A
When used together with: Cisco » N7k-m202cf-22l » Version: N/A
When used together with: Cisco » N7k-m206fq-23l » Version: N/A
When used together with: Cisco » N7k-m224xp-23l » Version: N/A
When used together with: Cisco » N7k-m324fq-25l » Version: N/A
When used together with: Cisco » N7k-m348xp-25l » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 1 » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 2 » Version: N/A
When used together with: Cisco » Nexus 7000 Supervisor 2e » Version: N/A
When used together with: Cisco » Nexus 7700 Supervisor 2e » Version: N/A
When used together with: Cisco » Nexus 7700 Supervisor 3e » Version: N/A
Cisco » Nx-os
Versions from including (>=) 8.2 and before (<) 8.3\(1\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9706 » Version: N/A
When used together with: Cisco » Mds 9710 » Version: N/A
When used together with: Cisco » Mds 9718 » Version: N/A