Summary
Cisco heeft meerdere kwetsbaarheden verholpen in Cisco NX-OS Software.
Details
Interpretaties
De kwetsbaarheden betreffen verschillende componenten van Cisco NX-OS Software.
- Een kwetsbaarheid in de Python interpreter maakt het mogelijk voor een geauthenticeerde lokale aanvaller met lage privileges om de Python sandbox te ontsnappen en willekeurige commando's op het onderliggende besturingssysteem uit te voeren.
- Een andere kwetsbaarheid in de NX-API feature laat ongeauthenticeerde externe aanvallers toe om via onvoldoende inputvalidatie van HTTP-verzoeken willekeurige code met rootrechten uit te voeren of een denial of service te veroorzaken.
- Daarnaast kunnen ongeauthenticeerde externe aanvallers door het ontbreken van adequate rate limiting op bepaalde protocollen systeembronnen uitputten, wat leidt tot tijdelijke verstoringen in routing en control plane protocollen.
- Verder zijn er meerdere intern ontdekte kwetsbaarheden die betrekking hebben op improper neutralization (CWE-707), improper access control (CWE-284), improper input validation (CWE-20), out-of-bounds read (CWE-125), improper handling of exceptional conditions (CWE-703) en out-of-bounds write (CWE-787). Deze kwetsbaarheden kunnen leiden tot verschillende vormen van ongeautoriseerde toegang, systeeminstabiliteit of verstoring van de werking van het netwerkbesturingssysteem.
De kwetsbaarheden zijn geïdentificeerd tijdens interne beveiligingsreviews door het engineeringteam van Cisco en voor zover bekend is geen van de kwetsbaarheden actief misbruikt.
Oplossingen
Cisco heeft software hardening updates uitgebracht voor Cisco NX-OS Software om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 9
-
Critical 9.8
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
Critical 9.8
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
Critical 9.8
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to …
-
High 8.8
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
Medium 5.8
Cisco NX-OS Software Denial of Service Vulnerability
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An atta…
-
Medium 4.4
Cisco NX-OS Software Python Sandbox Escape Vulnerability
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vu…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-fBn58ELx
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7