CVE-2019-1803

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Root Privilege Escalation Vulnerability

MEDIUM

6.7

CVSS Score

Published: May 3, 2019 at 04:20 PM UTC

Updated: June 17, 2026 at 02:29 AM UTC

23 products affected across 1 vendorNexus 9000 Series Application Centric InfrastructureNexus 9508Nexus 93120Tx

Using Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode by Cisco?

Get instant alerts when new vulnerabilities affect Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.7

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authenticated, local attacker with administrator rights to gain elevated privileges as the root user on an affected device. The vulnerability is due to overly permissive file permissions of specific system files. An attacker could exploit this vulnerability by authenticating to an affected device, creating a crafted command string, and writing this crafted string to a specific file location. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid administrator credentials for the device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nexus 9000 Series Application Centric Infrastructure · Cisco

95%

All versions

cisco-nexus-93108tc-ex (environment) · cisco-nexus-93120tx (environment) · cisco-nexus-93128tx (environment) · cisco-nexus-93180lc-ex (environment) · cisco-nexus-93180tc-ex (environment) · cisco-nexus-93180yc-ex (environment) · cisco-nexus-93180yc-fx (environment) · cisco-nexus-9332pq (environment) · cisco-nexus-9336c-fx2 (environment) · cisco-nexus-9336pq-aci-spine (environment) · cisco-nexus-9348gc-fxp (environment) · cisco-nexus-9364c (environment) · cisco-nexus-9372px (environment) · cisco-nexus-9372px-e (environment) · cisco-nexus-9372tx (environment) · cisco-nexus-9372tx-e (environment) · cisco-nexus-9396px (environment) · cisco-nexus-9396tx (environment) · cisco-nexus-9504 (environment) · cisco-nexus-9508 (environment) · cisco-nexus-9516 (environment)

Nx OS · Cisconpm

60%

v < 14.1(1i)

Affected range stops below 14.1(1i), so it looks safe — our inference, not a vendor statement

Nexus 93108Tc-Ex · Ciscodevice

80%

All versions

Nexus 93120Tx · Ciscodevice

80%

All versions

Nexus 93128Tx · Ciscodevice

80%