CWE Code: 77
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary: a vulnerability in a specific cli command implementation of cisco nexus 9000 series aci mode switch software could allow an authenticated, local attacker to escape a restricted shell on an affected device. the vulnerability is due to insufficient sanitization of user-supplied input when issuing a specific cli command with parameters on an affected device. an attacker could exploit this vulnerability by authenticating to the device cli and issuing certain commands. a successful exploit could allow the attacker to escape the restricted shell and execute arbitrary commands with root-level privileges on the affected device. this vulnerability only affects cisco nexus 9000 series aci mode switches that are running a release prior to 14.0(3d).
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-03-06
Last Modified Date: 2019-10-09