Detections
Analytics
Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation (CVE-2015-4237)
high Tenable OT Security Plugin ID 501422
Synopsis
The remote OT asset is affected by a vulnerability.Description
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
Refer to the vendor advisory.See Also
http://tools.cisco.com/security/center/viewAlert.x?alertId=39583
Plugin Details
Severity: High
ID: 501422
Version: 1.2
Type: remote
Family: Tenable.ot
Published: 7/25/2023
Updated: 12/25/2023
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2015-4237
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:cisco:nx-os:4.1%282%29e1%281%29, cpe:/o:cisco:nx-os:6.2%2811b%29, cpe:/o:cisco:nx-os:6.2%2812%29, cpe:/o:cisco:nx-os:7.2%280%29zz%2899.1%29, cpe:/o:cisco:nx-os:7.2%280%29zz%2899.3%29, cpe:/o:cisco:nx-os:9.1%281%29sv1%283.1.8%29
Required KB Items: Tenable.ot/Cisco
Exploit Ease: No known exploits are available
Patch Publication Date: 7/3/2015
Vulnerability Publication Date: 7/3/2015
Reference Information
CVE: CVE-2015-4237