Cisco NX-OS Software Command Injection Vulnerability

TL;DR 📌

A command injection vulnerability has been identified in Cisco NX-OS Software that could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system. This vulnerability has a CVSS score of 4.4, indicating a Medium severity level. Cisco has released software updates to address this issue, but there are no workarounds available.

What happened 🕵️‍♂️

A vulnerability in the command-line interface (CLI) of Cisco NX-OS Software allows an authenticated, local attacker to perform a command injection attack on the operating system of affected devices. This vulnerability arises from insufficient validation of user-supplied input. If exploited, an attacker with valid user credentials could read and write files on the underlying operating system with the privileges of a non-root user account.

Affected products 🖥️

The following Cisco products are affected by this vulnerability:

• MDS 9000 Series Multilayer Switches
• Nexus 1000 Virtual Edge for VMware vSphere
• Nexus 3000 Series Switches
• Nexus 5500 Platform Switches
• Nexus 5600 Platform Switches
• Nexus 6000 Series Switches
• Nexus 7000 Series Switches
• Nexus 9000 Series Fabric Switches in ACI mode
• Nexus 9000 Series Switches in standalone NX-OS mode
• UCS 6400 Series Fabric Interconnects
• UCS 6500 Series Fabric Interconnects
• UCS X-Series Direct Fabric Interconnect 9108 100G

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds available to mitigate this vulnerability.

Risk in context 🎯

With a CVSS score of 4.4, this vulnerability is rated as Medium severity. It requires authenticated local access, meaning that an attacker must already have valid credentials to exploit it. While the risk of exploitation is limited to local access, the potential for unauthorized file access on the device’s operating system remains a concern.

Fast facts ⚡

• Vulnerability: Command injection in Cisco NX-OS Software
• CVSS Score: 4.4 (Medium)
• Exploitation: Requires authenticated local access
• Workarounds: None available
• Fixed Software: Updates released, specific versions not listed

For leadership 🧭

Executive summary. A logged-in user with valid credentials on Cisco NX-OS switches, MDS storage switches, Nexus platforms or UCS fabric interconnects can escape the CLI to read and write files on the host operating system. There is no workaround, so remediation depends on scheduling the software upgrade; treat it as routine patching rather than an emergency given the local-access requirement.

Why it matters:

• The flaw sits in the NX-OS CLI itself, so any account with CLI access to an affected switch, MDS director or UCS fabric interconnect is a potential launch point, not just admin-level users.
• Successful exploitation grants file read and write access on the underlying OS, which on network infrastructure can expose configuration data or allow tampering with system files.
• The affected list spans core switching gear (Nexus 3000/5500/5600/6000/7000/9000, MDS 9000) and UCS 6400/6500 fabric interconnects, meaning both data-centre networking and compute fabric management planes are in scope.
• No workaround exists, so the only mitigation path is the vendor-supplied software update, making version tracking across a mixed NX-OS fleet essential.

Now / Next / Later:

• Now: Identify every NX-OS device in the estate (MDS 9000, Nexus 1000/3000/5500/5600/6000/7000/9000, UCS 6400/6500 Fabric Interconnects, UCS X-Series 9108 Fabric Interconnect) and record its current software train against the fixed-release table.
• Next: During the next maintenance window, upgrade devices on the 4.1-and-earlier, 4.2 and 4.3 trains to 4.2(3p), 4.3(6a) or later as applicable; devices already on 6.0 are not affected.
• Later: Review who holds CLI login credentials on switching and fabric interconnect infrastructure and tighten local account provisioning, since this vulnerability is only reachable by someone already authenticated to the device.