CVE-2019-1615
Description
A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability is due to improper verification of digital signatures for software images. An attacker could exploit this vulnerability by loading an unsigned software image on an affected device. A successful exploit could allow the attacker to boot a malicious software image. Note: The fix for this vulnerability requires a BIOS upgrade as part of the software upgrade. For additional information, see the Details section of this advisory. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I7(5). Nexus 9000 Series Fabric Switches in ACI Mode are affected running software versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5).
Risk Information
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS Software | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 11.0 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 11.1 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 11.2 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 11.3 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 12.0 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 12.1 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 12.2 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 12.3 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 13.0 | NCM |
| Cisco NX-OS Software Image Signature Verification Vulnerability For Cisco NX-OS System Software in ACI Mode 13.1 | NCM |
| Improper Verification of Cryptographic Signature Vulnerability (CVE-2019-1615) | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-1706149 | Security Update for Cisco NX-OS Software 4.1(3a)UCSM |
| PATCH-1706157 | Security Update for Cisco NX-OS System Software in ACI Mode 11.0 9.2(1) |
| PATCH-1706159 | Security Update for Cisco NX-OS System Software in ACI Mode 11.1 9.2(1) |
| PATCH-1706161 | Security Update for Cisco NX-OS System Software in ACI Mode 11.2 9.2(1) |
| PATCH-1706163 | Security Update for Cisco NX-OS System Software in ACI Mode 11.3 9.2(1) |
| PATCH-1706165 | Security Update for Cisco NX-OS System Software in ACI Mode 12.0 9.2(1) |
| PATCH-1706167 | Security Update for Cisco NX-OS System Software in ACI Mode 12.1 9.2(1) |
| PATCH-1706169 | Security Update for Cisco NX-OS System Software in ACI Mode 12.2 9.2(1) |
| PATCH-1706171 | Security Update for Cisco NX-OS System Software in ACI Mode 12.3 9.2(1) |
| PATCH-1706173 | Security Update for Cisco NX-OS System Software in ACI Mode 13.0 9.2(1) |
| PATCH-1706175 | Security Update for Cisco NX-OS System Software in ACI Mode 13.1 9.2(1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234