A vulnerability was found in Cisco NX-OS (Router Operating System) (version now known). It has been rated as critical. Affected by this issue is some unknown processing of the component Software Patch Handler. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The vulnerability is due to insufficient NX-OS signature verification for software patches. An authenticated, local attacker could exploit this vulnerability to bypass signature verification and load a crafted, unsigned software patch on a targeted device. The attacker would need valid administrator credentials to perform this exploit. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Unified Computing System Manager. Cisco Bug IDs: CSCvf16494, CSCvf23655.

The bug was discovered 11/29/2017. The weakness was published 11/30/2017 as cisco-sa-20171129-nxos as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2017-12331 since 08/03/2017. The attack needs to be approached locally. Required for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/25/2021).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316267 (Cisco NX-OS System Software Patch Signature Bypass Vulnerability (cisco-sa-20171129-nxos)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at 110064, 110063, 110062 and 110061.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion