漏洞标题
N/A
漏洞描述信息
Cisco FXOS软件和Cisco NX-OS软件的写清除特性中的漏洞可能导致 authenticated 本地攻击者为受影响设备配置未经授权的管理员账户。该漏洞的存在是因为受影响的软件在使用某些CLI命令清除设备配置和重新加载设备时，未正确删除敏感文件。攻击者可以通过登录受影响设备并以管理员用户身份进行日志，并配置一个未经授权的账户。该账户不需要密码进行身份验证，仅通过与设备的安全外壳(SSH)连接可用。成功利用此漏洞可能会导致攻击者配置一个具有管理权限、不需要密码身份验证、且未在受影响设备的运行配置或审计日志中显示的未经授权的账户。该漏洞影响 Firepower 4100 Series 下一代防火墙、Firepower 9300 安全 appliances、Nexus 1000V 系列交换机、Nexus 1100 Series 云服务平台、Nexus 2000 Series Fabric Extenders、Nexus 3500 平台交换机、Nexus 4000 系列交换机、Nexus 5500 平台交换机、Nexus 5600 平台交换机、Nexus 6000 系列交换机、UCS 6100 Series Fabric 连接、UCS 6200 Series Fabric 连接、UCS 6300 Series Fabric 连接。Cisco bug ID: CSCvd13993, CSCvd34845, CSCvd34857, CSCvd34862, CSCvd34879, CSCve35753。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unauthorized administrator account for an affected device. The vulnerability exists because the affected software does not properly delete sensitive files when certain CLI commands are used to clear the device configuration and reload a device. An attacker could exploit this vulnerability by logging into an affected device as an administrative user and configuring an unauthorized account for the device. The account would not require a password for authentication and would be accessible only via a Secure Shell (SSH) connection to the device. A successful exploit could allow the attacker to configure an unauthorized account that has administrative privileges, does not require a password for authentication, and does not appear in the running configuration or the audit logs for the affected device. This vulnerability affects Firepower 4100 Series Next-Generation Firewalls, Firepower 9300 Security Appliance, Nexus 1000V Series Switches, Nexus 1100 Series Cloud Services Platforms, Nexus 2000 Series Fabric Extenders, Nexus 3500 Platform Switches, Nexus 4000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd13993, CSCvd34845, CSCvd34857, CSCvd34862, CSCvd34879, CSCve35753.
CVSS信息
N/A
漏洞类别
权限、特权和访问控制
漏洞标题
多款Cisco产品FXOS Software和NX-OS Software 权限许可和访问控制漏洞
漏洞描述信息
Cisco Firepower 4100 Series Next-Generation Firewalls等都是美国思科（Cisco）公司的产品。Cisco Firepower 4100 Series Next-Generation Firewalls是一款4100系列的防火墙设备。Nexus 1000V Series Switches是一款1000V系列的交换机设备。FXOS Software是一套运行在思科安全设备中的防火墙软件。NX-OS Software是运行在思科交换机设备中的一套数据中心级操作
CVSS信息
N/A
漏洞类别
授权问题