CVE-2019-1730: cisco cisco nx-os software
Vulnerability summary
CVE-2019-1730 is a high (CVSS 7.2) vulnerability in cisco cisco nx-os software. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.
Timeline
- 15-05-2019PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST6.0MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- cisco nx-os software≥ unspecified, < 8.3(1)
- nx-os≥ 7.0\(3\)i4, < 7.0\(3\)i4\(9\) | ≥ 7.0\(3\)i7, < 7.0\(3\)i7\(4\) | ≥ 8.1, < 8.3\(1\) | ≥ 7.0\(3\), < 7.0\(3\)f3\(5\)
1 vendor · 2 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-bash-bypassVendor AdvisoryX Refsource CISCO