Cisco Nexus 3000 and 9000 Series Switches Command Injection Vulnerability

A command injection vulnerability has been identified in Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode. This vulnerability allows an authenticated, local attacker with valid Administrator credentials to execute arbitrary commands on the underlying operating system of the affected device with root privileges. The issue arises from insufficient validation of certain elements within a software image, enabling an attacker to exploit it by installing a crafted image. Administrators are advised to validate the hash of any software image before installation.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected device's operating system with root privileges.

Remediation

Cisco has released software updates to address this vulnerability. For guidance on determining the best release for Cisco Nexus Switches, consult the Recommended Releases documents available on the Cisco website. Additionally, the Cisco Software Checker tool can be used to identify vulnerabilities in specific Cisco NX-OS software releases and find the earliest release that fixes them.