Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1804

A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The vulnerability is due to the presence of a default SSH key pair that is present in all devices. An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user. This vulnerability is only exploitable over IPv6; IPv4 is not vulnerable.

Published

2019-05-03T17:29:00.813

Last Modified

2024-11-21T04:37:24.863

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-310
  • Type: Primary
    CWE-1188
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco nexus_9332pq_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9332pq - No
Operating System cisco nexus_93180yc-ex_firmware 14.0\(3d\) Yes
Hardware cisco nexus_93180yc-ex - No
Operating System cisco nexus_93128tx_firmware 14.0\(3d\) Yes
Hardware cisco nexus_93128tx - No
Operating System cisco nexus_93120tx_firmware 14.0\(3d\) Yes
Hardware cisco nexus_93120tx - No
Operating System cisco nexus_93108tc-ex_firmware 14.0\(3d\) Yes
Hardware cisco nexus_93108tc-ex - No
Operating System cisco nexus_9516_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9516 - No
Operating System cisco nexus_9508_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9508 - No
Operating System cisco nexus_9504_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9504 - No
Operating System cisco nexus_9500_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9500 - No
Operating System cisco nexus_9396tx_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9396tx - No
Operating System cisco nexus_9396px_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9396px - No
Operating System cisco nexus_9372tx_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9372tx - No
Operating System cisco nexus_9372px_firmware 14.0\(3d\) Yes
Hardware cisco nexus_9372px - No
References