A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability.

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, Cisco Nexus Operating System (NX-OS) is affected by following vulnerability

  - A vulnerability in the implementation of a CLI     diagnostic command in Cisco FXOS Software and Cisco NX-     OS Software could allow an authenticated, local attacker     to view sensitive system files that should be     restricted. The attacker could use this information to     conduct additional reconnaissance attacks.The     vulnerability is due to incomplete role-based access     control (RBAC) verification. An attacker could exploit     this vulnerability by authenticating to the device and     issuing a specific CLI diagnostic command with crafted     user-input parameters. An exploit could allow the     attacker to perform an arbitrary read of a file on the     device, and the file may contain sensitive information.
    The attacker needs valid device credentials to exploit     this vulnerability. (CVE-2019-1734)

Please see the included Cisco BIDs and Cisco Security Advisory for more information

According to its self-reported version, Cisco Firepower Extensible Operating System (FXOS) is affected by following vulnerability

  - A vulnerability in the implementation of a CLI     diagnostic command in Cisco FXOS Software and Cisco NX-     OS Software could allow an authenticated, local attacker     to view sensitive system files that should be     restricted. The attacker could use this information to     conduct additional reconnaissance attacks.The     vulnerability is due to incomplete role-based access     control (RBAC) verification. An attacker could exploit     this vulnerability by authenticating to the device and     issuing a specific CLI diagnostic command with crafted     user-input parameters. An exploit could allow the     attacker to perform an arbitrary read of a file on the     device, and the file may contain sensitive information.
    The attacker needs valid device credentials to exploit     this vulnerability. (CVE-2019-1734)

Please see the included Cisco BIDs and Cisco Security Advisory for more information

ID	Name	Product	Family	Severity
501301	Cisco FXOS and NX-OS Software Sensitive File Read Information Disclosure (CVE-2019-1734)	Tenable OT Security	Tenable.ot	medium
136482	Cisco NX-OS Software Sensitive File Read Information Disclosure Vulnerability (cisco-sa-20190515-nxos-fxos-info)	Nessus	CISCO	medium
136481	Cisco NX-OS Software Sensitive File Read Information Disclosure Vulnerability (cisco-sa-20190515-nxos-fxos-info)	Nessus	CISCO	medium

Detections

Analytics

CVE-2019-1734

medium

Tenable Plugins

medium

medium

medium