CVE-2019-1728

Cisco FXOS and NX-OS Software Secure Configuration Bypass Vulnerability

MEDIUM

6.7

CVSS Score

Published: May 15, 2019 at 04:45 PM UTC

Updated: June 17, 2026 at 02:29 AM UTC

40 products affected across 1 vendorNx OSNexus 7000Nexus 7700

Using Cisco NX-OS Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco NX-OS Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.7

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nx OS · Cisconpm

95%

v < 8.3(1)2.4 ≤ v < 2.4.1.1014.0 ≤ v < 4.0(1a)6.0(2)a8 ≤ v < 6.0(2)a8(11)6.2 ≤ v < 6.2(22)7.0(3) ≤ v < 7.0(3)i7(3)7.0(3)i7 ≤ v < 7.0(3)i7(3)7.2 ≤ v < 7.3(3)d1(1)7.3 ≤ v < 7.3(4)n1(1)8.0 ≤ v < 8.3(1)8.1 ≤ v < 8.1(1b)8.2 ≤ v < 8.3(1)

Affected range stops below 2.4.1.101, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0(1a), so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0(2)a8(11), so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2(22), so it looks safe — our inference, not a vendor statement

Affected range stops below 7.0(3)i7(3), so it looks safe — our inference, not a vendor statement

Affected range stops below 7.3(3)d1(1), so it looks safe — our inference, not a vendor statement

Affected range stops below 7.3(4)n1(1), so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1(1b), so it looks safe — our inference, not a vendor statement

Affected range stops below 8.3(1), so it looks safe — our inference, not a vendor statement

cisco-firepower-4110 (environment) · cisco-firepower-4115 (environment) · cisco-firepower-4120 (environment) · cisco-firepower-4125 (environment) · cisco-firepower-4140 (environment) · cisco-firepower-4145 (environment) · cisco-firepower-4150 (environment) · cisco-firepower-9300 (environment) · cisco-mds-9000 (environment) · cisco-mds-9100 (environment) · cisco-mds-9200 (environment) · cisco-mds-9500 (environment) · cisco-mds-9700 (environment) · cisco-nexus-3000 (environment) · cisco-nexus-3100 (environment) · cisco-nexus-3100-z (environment) · cisco-nexus-3100v (environment) · cisco-nexus-3200 (environment) · cisco-nexus-3400 (environment) · cisco-nexus-3500 (environment) · cisco-nexus-3524-x (environment) · cisco-nexus-3524-xl (environment) · cisco-nexus-3548-x (environment) · cisco-nexus-3548-xl (environment) · cisco-nexus-3600 (environment) · cisco-nexus-5500 (environment) · cisco-nexus-5600 (environment) · cisco-nexus-6000 (environment) · cisco-nexus-7000 (environment) · cisco-nexus-7700 (environment) · cisco-nexus-9000 (environment) · cisco-nexus-9200 (environment) · cisco-nexus-9300 (environment) · cisco-nexus-9500 (environment) · cisco-ucs-6248up (environment) · cisco-ucs-6296up (environment) · cisco-ucs-6332 (environment) · cisco-usc-6324 (environment) · cisco-usc-6332-16up (environment)

Firepower 4110 · Ciscodevice

80%

All versions

Firepower 4115 · Ciscodevice

80%

All versions

Firepower 4120 · Ciscodevice

80%

All versions

Firepower 4125 · Ciscodevice

80%

All versions