CVE-2019-1605 is a critical vulnerability in the NX-API feature of Cisco NX-OS Software, affecting various Nexus and MDS 9000 Series switches. This flaw, caused by incorrect input validation, allows an authenticated, local attacker to execute arbitrary code as root by sending a crafted HTTP/HTTPS request, leading to a buffer overflow. With a CVSS score of 7.8 (High), the vulnerability has a low attack complexity and requires local authentication, but successful exploitation grants full control (Confidentiality, Integrity, Availability High). The NX-API feature is disabled by default, mitigating some risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or ExploitDB entries. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or active threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.3, < 8.1\(1\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
< 6.0\(2\)a8\(8\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.0\(3\)i5, < 7.0\(3\)i7\(1\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.0\(3\)f3, < 7.0\(3\)f3\(5\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.2, < 7.3\(3\)d1\(1\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.