CVE-2019-1727 Cisco NX-OS Software Python Parser Privilege Escalation Vulnerability
Authenticated local attackers can escape the Python sandbox to execute arbitrary commands and elevate privileges on Cisco NX-OS devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1727?
CVE-2019-1727 is a medium-severity vulnerability in Cisco Nx-Os, published on 15 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker's privilege level. To exploit this vulnerability, the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit.
Which versions are affected by CVE-2019-1727?
It affects 1 product.
Products include Cisco Nx-Os.
How do I fix CVE-2019-1727?
No fix has been published for CVE-2019-1727 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-1727 being exploited?
There is no known exploitation of CVE-2019-1727 in the wild and no public exploit code.
Other vulnerabilities in Cisco Nx-Os
Sources
Also known as GHSA-h9j3-p28g-73q9.