CVE-2019-12662 Cisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass Vulnerability

Medium 6.7 Published 25 Sep 2019 Updated 20 Nov 2024

Authenticated local attackers can bypass signature verification to load malicious OVA images, enabling code execution on Cisco network devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12662?

CVE-2019-12662 is a medium-severity vulnerability in Cisco Ios Xe, published on 25 Sep 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper signature verification during the installation of an Open Virtual Appliance (OVA) image. An authenticated, local attacker could exploit this vulnerability and load a malicious, unsigned OVA image on an affected device. A successful exploit could allow an attacker to perform code execution on a crafted software OVA image.

Weakness: CWE-347

Which versions are affected by CVE-2019-12662?

It affects 52 products.

Products include Cisco Ios Xe, Cisco Nexus 3016 Firmware, Cisco Nexus 3048 Firmware, Cisco Nexus 3064-T Firmware, Cisco Nexus 3064 Firmware, Cisco Nexus 31108pc-v Firmware and 46 more.

How do I fix CVE-2019-12662?

No fix has been published for CVE-2019-12662 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-12662 being exploited?

There is no known exploitation of CVE-2019-12662 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-pqr2-367x-jwhw.