CVE-2019-1727
Last modified
CVE-2019-1727 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker's privilege level. To exploit this vulnerability, the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Nx-Os | >= 5.2, < 8.1\(1b\) |
| Cisco | Nx-Os | >= 8.2, < 8.3\(1\) |
| Cisco | Nx-Os | >= 7.0\(3\)i4, < 7.0\(3\)i4\(8\) |
| Cisco | Nx-Os | >= 7.0\(3\)i5, < 7.0\(3\)i7\(3\) |
| Cisco | Nx-Os | >= 7.3, < 7.3\(4\)n1\(1\) |
| Cisco | Nx-Os | >= 6.2, < 7.3\(3\)d1\(1\) |
| Cisco | Nx-Os | >= 8.0, < 8.3\(1\) |
References
- http://www.securityfocus.com/bid/108341Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/108341Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1727?
How severe is CVE-2019-1727?
How do I fix CVE-2019-1727?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-17263In libyal libfwsi before 20191006, libfwsi_extension_block_c…3.3
- CVE-2019-17264In libyal liblnk before 20191006, liblnk_location_informatio…3.3
- CVE-2019-17266libsoup from versions 2.65.1 until 2.68.1 have a heap-based …9.8
- CVE-2019-17267A Polymorphic Typing issue was discovered in FasterXML jacks…9.8
- CVE-2019-17268The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed…9.8
- CVE-2019-17269Intellian Remote Access 3.18 allows remote attackers to exec…9.8
- CVE-2019-17270Yachtcontrol through 2019-10-06: It's possible to perform di…9.8
- CVE-2019-17271vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/g…4.9
- CVE-2019-17272All versions of ONTAP Select Deploy administration utility a…7.2
- CVE-2019-17273E-Series SANtricity OS Controller Software version 11.60.0 i…6.5
- CVE-2019-17274NetApp FAS 8300/8700 and AFF A400 Baseboard Management Contr…7.8
- CVE-2019-17275OnCommand Cloud Manager versions prior to 3.8.0 are suscepti…9.8
Are you affected by CVE-2019-1727?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST