Vulnslist

find the latest Cisco vulnerabilities

Cisco NX-OS Software NX-API Cross-Site Request Forgery Vulnerability

cisco-sa-nxos-nxapi-csrf-wRMzWL9z · High · Published · Updated

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.  This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nxapi-csrf-wRMzWL9z This advisory is part of the February 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: February 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

However, because a device is not affected by this vulnerability if the NX-API is not configured, administrators may consider disabling the NX-API as a mitigation.

CVEsCVE-2021-1227
Cisco Bug IDsCSCvr82908, CSCvu67365, CSCvv92342
CVSS ScoreBase 8.1
Base 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
Product Names From Source
Cisco NX-OS Software 6.0(2)A8(1), Cisco NX-OS Software 6.0(2)A8(2), Cisco NX-OS Software 6.0(2)A8(3), Cisco NX-OS Software 6.0(2)A8(4), Cisco NX-OS Software 6.0(2)A8(4a), Cisco NX-OS Software 6.0(2)A8(5), Cisco NX-OS Software 6.0(2)A8(6), Cisco NX-OS Software 6.0(2)A8(7), Cisco NX-OS Software 6.0(2)A8(7a), Cisco NX-OS Software 6.0(2)A8(7b), Cisco NX-OS Software 6.0(2)A8(8), Cisco NX-OS Software 6.0(2)A8(9), Cisco NX-OS Software 6.0(2)A8(10a), Cisco NX-OS Software 6.0(2)A8(10), Cisco NX-OS Software 6.0(2)A8(11), Cisco NX-OS Software 6.0(2)A8(11a), Cisco NX-OS Software 6.0(2)A8(11b), Cisco NX-OS Software 7.0(3)F3(1), Cisco NX-OS Software 7.0(3)F3(2), Cisco NX-OS Software 7.0(3)F3(3), Cisco NX-OS Software 7.0(3)F3(3a), Cisco NX-OS Software 7.0(3)F3(4), Cisco NX-OS Software 7.0(3)F3(3c), Cisco NX-OS Software 7.0(3)F3(5), Cisco NX-OS Software 7.0(3)I4(1), Cisco NX-OS Software 7.0(3)I4(2), Cisco NX-OS Software 7.0(3)I4(3), Cisco NX-OS Software 7.0(3)I4(4), Cisco NX-OS Software 7.0(3)I4(5), Cisco NX-OS Software 7.0(3)I4(6), Cisco NX-OS Software 7.0(3)I4(7), Cisco NX-OS Software 7.0(3)I4(8), Cisco NX-OS Software 7.0(3)I4(8a), Cisco NX-OS Software 7.0(3)I4(8b), Cisco NX-OS Software 7.0(3)I4(8z), Cisco NX-OS Software 7.0(3)I4(1t), Cisco NX-OS Software 7.0(3)I4(6t), Cisco NX-OS Software 7.0(3)I4(9), Cisco NX-OS Software 7.0(3)I5(1), Cisco NX-OS Software 7.0(3)I5(2), Cisco NX-OS Software 7.0(3)I5(3), Cisco NX-OS Software 7.0(3)I5(3a), Cisco NX-OS Software 7.0(3)I5(3b), Cisco NX-OS Software 7.0(3)I6(1), Cisco NX-OS Software 7.0(3)I6(2), Cisco NX-OS Software 7.0(3)I7(1), Cisco NX-OS Software 7.0(3)I7(2), Cisco NX-OS Software 7.0(3)I7(3), Cisco NX-OS Software 7.0(3)I7(4), Cisco NX-OS Software 7.0(3)I7(5), Cisco NX-OS Software 7.0(3)I7(5a), Cisco NX-OS Software 7.0(3)I7(3z), Cisco NX-OS Software 7.0(3)I7(6), Cisco NX-OS Software 7.0(3)I7(6z), Cisco NX-OS Software 7.0(3)I7(7), Cisco NX-OS Software 7.0(3)I7(8), Cisco NX-OS Software 7.3(0)D1(1), Cisco NX-OS Software 7.3(0)DX(1), Cisco NX-OS Software 7.3(0)DY(1), Cisco NX-OS Software 7.3(0)N1(1), Cisco NX-OS Software 7.3(0)N1(1b), Cisco NX-OS Software 7.3(0)N1(1a), Cisco NX-OS Software 7.3(1)D1(1), Cisco NX-OS Software 7.3(1)DY(1), Cisco NX-OS Software 7.3(1)N1(1), Cisco NX-OS Software 7.3(2)D1(1), Cisco NX-OS Software 7.3(2)D1(2), Cisco NX-OS Software 7.3(2)D1(3), Cisco NX-OS Software 7.3(2)D1(3a), Cisco NX-OS Software 7.3(2)D1(1d), Cisco NX-OS Software 7.3(2)N1(1), Cisco NX-OS Software 7.3(2)N1(1b), Cisco NX-OS Software 7.3(2)N1(1c), Cisco NX-OS Software 7.3(3)N1(1), Cisco NX-OS Software 8.1(1), Cisco NX-OS Software 8.1(2), Cisco NX-OS Software 8.1(2a), Cisco NX-OS Software 8.1(1a), Cisco NX-OS Software 8.1(1b), Cisco NX-OS Software 8.2(1), Cisco NX-OS Software 8.2(2), Cisco NX-OS Software 8.2(3), Cisco NX-OS Software 8.2(4), Cisco NX-OS Software 8.2(5), Cisco NX-OS Software 8.2(6), Cisco NX-OS Software 8.3(1), Cisco NX-OS Software 8.3(2), Cisco NX-OS Software 9.2(1), Cisco NX-OS Software 9.2(2), Cisco NX-OS Software 9.2(2t), Cisco NX-OS Software 9.2(3), Cisco NX-OS Software 9.2(3y), Cisco NX-OS Software 9.2(4), Cisco NX-OS Software 9.2(2v), Cisco NX-OS Software 7.3(4)N1(1), Cisco NX-OS Software 7.3(4)N1(1a), Cisco NX-OS Software 7.3(3)D1(1), Cisco NX-OS Software 7.0(3)IA7(1), Cisco NX-OS Software 7.0(3)IA7(2), Cisco NX-OS Software 7.0(3)IM7(2), Cisco NX-OS Software 7.3(4)D1(1), Cisco NX-OS Software 7.3(5)N1(1), Cisco NX-OS Software 8.4(1), Cisco NX-OS Software 8.4(1a), Cisco NX-OS Software 8.4(2), Cisco NX-OS Software 8.4(2a), Cisco NX-OS Software 8.4(3), Cisco NX-OS Software 8.4(2b), Cisco NX-OS Software 9.3(1), Cisco NX-OS Software 9.3(2), Cisco NX-OS Software 9.3(1z), Cisco NX-OS Software 7.3(6)N1(1), Cisco NX-OS Software 7.3(6)N1(1a), Cisco NX-OS Software 7.3(5)D1(1), Cisco NX-OS Software 7.3(7)N1(1), Cisco NX-OS Software 7.3(7)N1(1a), Cisco NX-OS Software 7.3(7)N1(1b), Cisco NX-OS Software 7.3(6)D1(1), Cisco NX-OS Software, Cisco MDS 9000 Multilayer Directors and Fabric Switches, Cisco Nexus 7000 Series Switches, Cisco Nexus 5000 Series Switches, Cisco Nexus 3000 Series Switches, Cisco Nexus 6000 Series Switches, Cisco Nexus 9000 Series Switches

Related Products

Product CVE Evidence
Cisco Nexus Dashboard CVE-2021-1227 Cisco OpenVuln
Cisco MDS 9000 Family of Multilayer Switches CVE-2021-1227 Cisco OpenVuln
Cisco Firepower Extensible Operating System (FXOS) CVE-2021-1227 Cisco OpenVuln
Cisco Catalyst PON Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 9000 Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 7000 Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 6000 Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 5000 Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 3000 Series Switches CVE-2021-1227 Cisco OpenVuln
Cisco Nexus 3000 Series Switch CVE-2021-1227 Cisco OpenVuln
Cisco NX-OS Software CVE-2021-1227 Cisco OpenVuln
Cisco MDS 9000 Multilayer Directors and Fabric Switches CVE-2021-1227 Cisco OpenVuln