CVE-2019-1730 (CNNVD-201905-644)
中文标题:
Cisco NX-OS Software 权限许可和访问控制问题漏洞
英文标题:
Cisco NX-OS Software Bash Bypass Guest Shell Vulnerability
漏洞描述
中文描述:
Cisco NX-OS Software是美国思科（Cisco）公司的一套交换机使用的数据中心级操作系统软件。 Cisco NX-OS Software中Bash shell的实现存在权限许可和访问控制问题漏洞。该漏洞源于网络系统或产品缺乏有效的权限许可和访问控制措施。以下产品及版本受到影响：Cisco Nexus 3000 Series Switches；Nexus 3500 Platform Switches；Nexus 3600 Platform Switches；Nexus 7000 Series Switches；Nexus 7700 Series Switches；Nexus 9000 Series Switches in standalone NX-OS mode；Nexus 9500 R-Series Switching Platform。
英文描述:
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco NX-OS Software | - | < 8.3(1) | - |
cpe:2.3:a:cisco:cisco_nx-os_software:*:*:*:*:*:*:*:*
|
| cisco | nx-os | * | - | - |
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.0 (cna)
MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1730 |
2025-11-11 15:20:08 | 2025-11-11 07:35:38 |
| NVD | nvd_CVE-2019-1730 |
2025-11-11 14:56:22 | 2025-11-11 07:44:09 |
| CNNVD | cnnvd_CNNVD-201905-644 |
2025-11-11 15:10:12 | 2025-11-11 07:54:33 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 权限许可和访问控制问题
- cnnvd_id: 未提取 -> CNNVD-201905-644
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']