Vulnslist

find the latest Cisco vulnerabilities

Cisco FXOS and NX-OS Software Unauthorized Administrator Account Vulnerability

cisco-sa-20180620-nxosadmin · High · Published · Updated

A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete sensitive files when certain CLI commands are used to clear the device configuration and reload a device. An attacker could exploit this vulnerability by logging into an affected device as an administrative user and configuring an unauthorized account for the device. The account would not require a password for authentication and would be accessible only via a Secure Shell (SSH) connection to the device. A successful exploit could allow the attacker to configure an unauthorized account that has administrative privileges, does not require a password for authentication, and does not appear in the running configuration or the audit logs for the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxosadmin This advisory is part of the June 2018 Cisco FXOS and NX-OS Software Security Advisory Collection, which includes 24 Cisco Security Advisories that describe 24 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2018 Cisco FXOS and NX-OS Software Security Advisory Collection.

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2018-0294
Cisco Bug IDsCSCvd34879, CSCve35753, CSCvd34845, CSCvd34857, CSCvd13993, CSCvd34862
CVSS ScoreBase 6.4
Base 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco Unified Computing System (Managed), Cisco NX-OS Software 4.1(2)E1(1), Cisco NX-OS Software 4.1(2)E1(1b), Cisco NX-OS Software 4.1(2)E1(1d), Cisco NX-OS Software 4.1(2)E1(1e), Cisco NX-OS Software 4.1(2)E1(1f), Cisco NX-OS Software 4.1(2)E1(1g), Cisco NX-OS Software 4.1(2)E1(1h), Cisco NX-OS Software 4.1(2)E1(1i), Cisco NX-OS Software 4.1(2)E1(1j), Cisco NX-OS Software 4.1(2)E1(1m), Cisco NX-OS Software 4.1(2)E1(1c), Cisco NX-OS Software 4.1(2)E1(1n), Cisco NX-OS Software 4.1(2)E1(1k), Cisco NX-OS Software 4.1(2)E1(1o), Cisco NX-OS Software 4.1(2)E1(1q), Cisco NX-OS Software 4.1(2)E1(1l), Cisco NX-OS Software 4.1(2)E1(1p), Cisco NX-OS Software 4.2(1)SV1(4), Cisco NX-OS Software 4.2(1)SV1(4a), Cisco NX-OS Software 4.2(1)SV1(4b), Cisco NX-OS Software 4.2(1)SV1(5.1), Cisco NX-OS Software 4.2(1)SV1(5.1a), Cisco NX-OS Software 4.2(1)SV1(5.2), Cisco NX-OS Software 4.2(1)SV1(5.2b), Cisco NX-OS Software 4.2(1)SV2(1.1), Cisco NX-OS Software 4.2(1)SV2(1.1a), Cisco NX-OS Software 4.2(1)SV2(2.1), Cisco NX-OS Software 4.2(1)SV2(2.1a), Cisco NX-OS Software 4.2(1)SV2(2.2), Cisco NX-OS Software 4.2(1)SV2(2.3), Cisco NX-OS Software 5.0(3)A1(1), Cisco NX-OS Software 5.0(3)A1(2), Cisco NX-OS Software 5.0(3)A1(2a), Cisco NX-OS Software 5.2(1)SM1(5.1), Cisco NX-OS Software 5.2(1)SV3(1.4), Cisco NX-OS Software 5.2(1)SV3(1.1), Cisco NX-OS Software 5.2(1)SV3(1.3), Cisco NX-OS Software 5.2(1)SV3(1.5a), Cisco NX-OS Software 5.2(1)SV3(1.5b), Cisco NX-OS Software 5.2(1)SV3(1.6), Cisco NX-OS Software 5.2(1)SV3(1.10), Cisco NX-OS Software 5.2(1)SV3(1.15), Cisco NX-OS Software 5.2(1)SV3(2.1), Cisco NX-OS Software 5.2(1)SV3(2.5), Cisco NX-OS Software 5.2(1)SV3(2.8), Cisco NX-OS Software 5.2(1)SV3(3.1), Cisco NX-OS Software 5.2(1)SV3(1.2), Cisco NX-OS Software 5.2(1)SV3(1.4b), Cisco NX-OS Software 6.0(2)A1(1), Cisco NX-OS Software 6.0(2)A1(1a), Cisco NX-OS Software 6.0(2)A1(1b), Cisco NX-OS Software 6.0(2)A1(1c), Cisco NX-OS Software 6.0(2)A1(1d), Cisco NX-OS Software 6.0(2)A1(1e), Cisco NX-OS Software 6.0(2)A1(1f), Cisco NX-OS Software 6.0(2)A1(2d), Cisco NX-OS Software 6.0(2)A3(1), Cisco NX-OS Software 6.0(2)A3(2), Cisco NX-OS Software 6.0(2)A3(4), Cisco NX-OS Software 6.0(2)A4(1), Cisco NX-OS Software 6.0(2)A4(2), Cisco NX-OS Software 6.0(2)A4(3), Cisco NX-OS Software 6.0(2)A4(4), Cisco NX-OS Software 6.0(2)A4(5), Cisco NX-OS Software 6.0(2)A4(6), Cisco NX-OS Software 6.0(2)A6(1), Cisco NX-OS Software 6.0(2)A6(1a), Cisco NX-OS Software 6.0(2)A6(2), Cisco NX-OS Software 6.0(2)A6(2a), Cisco NX-OS Software 6.0(2)A6(3), Cisco NX-OS Software 6.0(2)A6(3a), Cisco NX-OS Software 6.0(2)A6(4), Cisco NX-OS Software 6.0(2)A6(4a), Cisco NX-OS Software 6.0(2)A6(5), Cisco NX-OS Software 6.0(2)A6(5a), Cisco NX-OS Software 6.0(2)A6(5b), Cisco NX-OS Software 6.0(2)A6(6), Cisco NX-OS Software 6.0(2)A6(7), Cisco NX-OS Software 6.0(2)A6(8), Cisco NX-OS Software 6.0(2)A7(1), Cisco NX-OS Software 6.0(2)A7(1a), Cisco NX-OS Software 6.0(2)A7(2), Cisco NX-OS Software 6.0(2)A7(2a), Cisco NX-OS Software 6.0(2)A8(1), Cisco NX-OS Software 6.0(2)A8(2), Cisco NX-OS Software 6.0(2)A8(3), Cisco NX-OS Software 6.0(2)A8(4), Cisco NX-OS Software 6.0(2)A8(4a), Cisco NX-OS Software 6.0(2)A8(5), Cisco NX-OS Software 6.0(2)A8(6), Cisco NX-OS Software 6.0(2)N1(1), Cisco NX-OS Software 6.0(2)N1(2), Cisco NX-OS Software 6.0(2)N1(2a), Cisco NX-OS Software 6.0(2)N2(1), Cisco NX-OS Software 6.0(2)N2(1b), Cisco NX-OS Software 6.0(2)N2(2), Cisco NX-OS Software 6.0(2)N2(3), Cisco NX-OS Software 6.0(2)N2(4), Cisco NX-OS Software 6.0(2)N2(5), Cisco NX-OS Software 6.0(2)N2(5a), Cisco NX-OS Software 6.0(2)N2(6), Cisco NX-OS Software 6.0(2)N2(7), Cisco NX-OS Software 7.0(0)N1(1), Cisco NX-OS Software 7.0(1)N1(1), Cisco NX-OS Software 7.0(2)N1(1), Cisco NX-OS Software 7.0(2)N1(1a), Cisco NX-OS Software 7.0(3)N1(1), Cisco NX-OS Software 7.0(4)N1(1), Cisco NX-OS Software 7.0(4)N1(1a), Cisco NX-OS Software 7.0(5)N1(1), Cisco NX-OS Software 7.0(5)N1(1a), Cisco NX-OS Software 7.0(6)N1(1), Cisco NX-OS Software 7.0(6)N1(4s), Cisco NX-OS Software 7.0(6)N1(3s), Cisco NX-OS Software 7.0(6)N1(2s), Cisco NX-OS Software 7.0(6)N1(1c), Cisco NX-OS Software 7.0(7)N1(1), Cisco NX-OS Software 7.0(7)N1(1b), Cisco NX-OS Software 7.0(7)N1(1a), Cisco NX-OS Software 7.0(8)N1(1), Cisco NX-OS Software 7.0(8)N1(1a), Cisco NX-OS Software 7.1(0)N1(1a), Cisco NX-OS Software 7.1(0)N1(1b), Cisco NX-OS Software 7.1(0)N1(2), Cisco NX-OS Software 7.1(0)N1(1), Cisco NX-OS Software 7.1(1)N1(1), Cisco NX-OS Software 7.1(1)N1(1a), Cisco NX-OS Software 7.1(2)N1(1), Cisco NX-OS Software 7.1(2)N1(1a), Cisco NX-OS Software 7.1(3)N1(1), Cisco NX-OS Software 7.1(3)N1(2), Cisco NX-OS Software 7.1(3)N1(5), Cisco NX-OS Software 7.1(3)N1(4), Cisco NX-OS Software 7.1(3)N1(3), Cisco NX-OS Software 7.1(3)N1(2a), Cisco NX-OS Software 7.1(3)N1(1b), Cisco NX-OS Software 7.1(4)N1(1), Cisco NX-OS Software 7.1(4)N1(1d), Cisco NX-OS Software 7.1(4)N1(1c), Cisco NX-OS Software 7.1(4)N1(1a), Cisco NX-OS Software 7.1(4)N1(1e), Cisco NX-OS Software 7.2(0)N1(1), Cisco NX-OS Software 7.2(1)N1(1), Cisco NX-OS Software 7.3(0)N1(1), Cisco NX-OS Software 7.3(0)N1(1b), Cisco NX-OS Software 7.3(0)N1(1a), Cisco NX-OS Software 7.3(1)N1(1), Cisco NX-OS Software

Related Products

Product CVE Evidence
Cisco Nexus Dashboard CVE-2018-0294 Cisco OpenVuln
Cisco Firepower Extensible Operating System (FXOS) CVE-2018-0294 Cisco OpenVuln
Cisco Catalyst PON Series Switches CVE-2018-0294 Cisco OpenVuln
Cisco Unified Computing System (Managed) CVE-2018-0294 Cisco OpenVuln
Cisco NX-OS Software CVE-2018-0294 Cisco OpenVuln