CWE Code: 77
Vulnerability Type: privilege_escalation
CVSS Score: 4.6
CWE Name:  Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary: a vulnerability in the cli of cisco enterprise nfv infrastructure software (nfvis) could allow an authenticated, high-privileged, local attacker to perform a command injection attack. the vulnerability is due to insufficient input validation of command parameters in the cli parser. an attacker could exploit this vulnerability by invoking a vulnerable cli command with crafted malicious parameters. an exploit could allow the attacker to execute arbitrary commands with a non-root user account on the underlying linux operating system of the affected device. cisco bug ids: cscvi09723.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-05-17
Last Modified Date: 2019-10-09