CVE-2019-1614 is a command injection vulnerability in the NX-API feature of Cisco NX-OS Software, affecting various Cisco Nexus and MDS 9000 Series Switches running specific older software versions. An authenticated, remote attacker can exploit this flaw by sending malicious HTTP/HTTPS packets to the management interface, due to incorrect input validation. This allows for arbitrary command execution with root privileges, leading to high impact on confidentiality, integrity, and availability. While the NX-API is disabled by default, its enablement makes affected systems vulnerable. There is no public exploit intelligence, active exploitation, or significant community discussion reported for this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.2, < 8.3\(2\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.3, < 8.1\(1b\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.0\(3\)i5, < 7.0\(3\)i7\(4\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
< 7.0\(3\)i4\(9\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* | ||
>= 7.0\(3\), < 7.0\(3\)i7\(4\)CPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.