CVE-2019-1614

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to incorrect input validation of user-supplied data by the NX-API subsystem. An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to perform a command-injection attack and execute arbitrary commands with root privileges. Note: NX-API is disabled by default. MDS 9000 Series Multilayer Switches are affected running software versions prior to 8.1(1b) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected running software versions prior to 7.3(4)N1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 7.3(3)D1(1) and 8.2(3).

• CWE-77
• CWE-78

• http://www.securityfocus.com/bid/107339Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinjVendor Advisory
• http://www.securityfocus.com/bid/107339Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinjVendor Advisory

Published

Mar 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16131framework/admin/modulec_control.php in OKLite v1.2.25 has an…8.8
• CVE-2019-16132An issue was discovered in OKLite v1.2.25. framework/admin/t…6.5
• CVE-2019-16133An issue was discovered in eteams OA v4.0.34. Because the se…6.5
• CVE-2019-16137An issue was discovered in the spin crate before 0.5.2 for R…7.5
• CVE-2019-16138An issue was discovered in the image crate before 0.21.3 for…9.8
• CVE-2019-16139An issue was discovered in the compact_arena crate before 0.…9.8
• CVE-2019-16140An issue was discovered in the chttp crate before 0.1.3 for …9.8
• CVE-2019-16141An issue was discovered in the once_cell crate before 1.0.1 …7.5
• CVE-2019-16142An issue was discovered in the renderdoc crate before 0.5.0 …9.8
• CVE-2019-16143An issue was discovered in the blake2 crate before 0.8.1 for…9.8
• CVE-2019-16144An issue was discovered in the generator crate before 0.6.18…7.5
• CVE-2019-16145The breadcrumbs contributed module through 0.2.0 for Padrino…6.1