CVE-2019-1614
Cisco NX-OS Software NX-API Command Injection Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to incorrect input validation of user-supplied data by the NX-API subsystem. An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to perform a command-injection attack and execute arbitrary commands with root privileges. Note: NX-API is disabled by default. MDS 9000 Series Multilayer Switches are affected running software versions prior to 8.1(1b) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected running software versions prior to 7.3(4)N1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 7.3(3)D1(1) and 8.2(3).
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.0 | High8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 4.1% · top 9.3% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
Cisco · MDS 9000 Series Multilayer Switches
- affected unspecified – < 8.1(1b)
- affected unspecified – < 8.2(3)
Cisco · Nexus 3000 Series Switches
- affected unspecified – < 7.0(3)I4(9)
- affected unspecified – < 7.0(3)I7(4)
Cisco · Nexus 3500 Platform Switches
- affected unspecified – < 7.0(3)I7(4)
Cisco · Nexus 2000, 5500, 5600, and 6000 Series Switches
- affected unspecified – < 7.3(4)N1(1)
Cisco · Nexus 9000 Series Switches in Standalone NX-OS Mode
- affected unspecified – < 7.0(3)I4(9)
- affected unspecified – < 7.0(3)I7(4)
Cisco · Nexus 7000 and 7700 Series Switches
- affected unspecified – < 7.3(3)D1(1)
- affected unspecified – < 8.2(3)
What to do
Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References (2)
- 107339 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20190306 Cisco NX-OS Software NX-API Command Injection Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-1614)Record last updated .