Vulnerability Details : CVE-2019-1813
A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
Exploit prediction scoring system (EPSS) score for CVE-2019-1813
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2019-1813
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
6.7
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
0.8
|
5.9
|
Cisco Systems, Inc. |
6.7
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
0.8
|
5.9
|
NIST |
CWE ids for CVE-2019-1813
-
The product does not verify, or incorrectly verifies, the cryptographic signature for data.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2019-1813
-
http://www.securityfocus.com/bid/108425
Cisco NX-OS CLI Command Software Multiple Security VulnerbailitiesBroken Link;Third Party Advisory;VDB Entry
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2
Cisco NX-OS CLI Command Software Image Signature Verification VulnerabilitiesVendor Advisory
Products affected by CVE-2019-1813
- cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*