CVE-2019-1601 (CNNVD-201903-183)
中文标题:
Cisco NX-OS Software 访问控制错误漏洞
英文标题:
Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability
漏洞描述
中文描述:
Cisco NX-OS Software是美国思科（Cisco）公司的一套交换机使用的数据中心级操作系统软件。 Cisco NX-OS Software中的文件系统权限存在访问控制错误漏洞，该漏洞源于程序没有执行较严格的文件系统权限。本地攻击者可通过访问并修改受限制的文件利用该漏洞使用配置文件内容，绕过身份验证并以任意用户身份进行登录。以下产品和版本受到影响：Cisco MDS 9000 Series Multilayer Switches 6.2(25)之前版本，8.1(1b)之前版本，8.3(1)之前版本；Nexus 3000 Series Switches 7.0(3)I4(9)之前版本，7.0(3)I7(4)之前版本；Nexus 3500 Platform Switches 6.0(2)A8(10)之前版本，7.0(3)I7(4)之前版本；Nexus 3600 Platform Switches 7.0(3)F3(5)之前版本；Nexus 2000 Series Switches 7.1(5)N1(1b)之前版本，7.3(3)N1(1)之前版本；Nexus 5500 Series Switches 7.1(5)N1(1b)之前版本，7.3(3)N1(1)之前版本；Nexus 5600 Series Switches 7.1(5)N1(1b)之前版本，7.3(3)N1(1)之前版本；Nexus 6000 Series Switches 7.1(5)N1(1b)之前版本，7.3(3)N1(1)之前版本；Nexus 7000 and 7700 Series Switches 6.2(22)之前版本，7.3(3)D1(1)之前版本，8.2(3)之前版本；Nexus 9000 Series Switches-Standalone 7.0(3)I4(9)之前版本，7.0(3)I7(4)之前版本；Nexus 9500 R-Series Line Cards and Fabric Modules 7.0(3)F3(5)之前版本。
英文描述:
A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical configuration file. The vulnerability is due to a failure to impose strict filesystem permissions on the targeted device. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow an attacker to use the content of this configuration file to bypass authentication and log in as any user of the device. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25), 8.1(1b), and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | MDS 9000 Series Multilayer Switches | - | < 6.2(25) | - |
cpe:2.3:a:cisco:mds_9000_series_multilayer_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 3000 Series Switches | - | < 7.0(3)I4(9) | - |
cpe:2.3:a:cisco:nexus_3000_series_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 3500 Platform Switches | - | < 6.0(2)A8(10) | - |
cpe:2.3:a:cisco:nexus_3500_platform_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 3600 Platform Switches | - | < 7.0(3)F3(5) | - |
cpe:2.3:a:cisco:nexus_3600_platform_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 2000, 5500, 5600, and 6000 Series Switches | - | < 7.1(5)N1(1b) | - |
cpe:2.3:a:cisco:nexus_2000,_5500,_5600,_and_6000_series_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 7000 and 7700 Series Switches | - | < 6.2(22) | - |
cpe:2.3:a:cisco:nexus_7000_and_7700_series_switches:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 9000 Series Switches-Standalone | - | < 7.0(3)I4(9) | - |
cpe:2.3:a:cisco:nexus_9000_series_switches-standalone:*:*:*:*:*:*:*:*
|
| Cisco | Nexus 9500 R-Series Line Cards and Fabric Modules | - | < 7.0(3)F3(5) | - |
cpe:2.3:a:cisco:nexus_9500_r-series_line_cards_and_fabric_modules:*:*:*:*:*:*:*:*
|
| cisco | nx-os | * | - | - |
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.0 (cna)
HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1601 |
2025-11-11 15:20:08 | 2025-11-11 07:35:36 |
| NVD | nvd_CVE-2019-1601 |
2025-11-11 14:56:20 | 2025-11-11 07:44:08 |
| CNNVD | cnnvd_CNNVD-201903-183 |
2025-11-11 15:10:10 | 2025-11-11 07:54:24 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201903-183
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 16 -> 9
- data_sources: ['cve'] -> ['cve', 'nvd']