1. Home
  2. CVE Database
  3. CVE-2019-1734
MEDIUM · 5.5

CVE-2019-1734

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that shoul...

Vulnerability Description

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
CiscoFirepower Extensible Operating System< 2.2.2.91
CiscoFirepower 4110-
CiscoFirepower 4112-
CiscoFirepower 4115-
CiscoFirepower 4120-
CiscoFirepower 4125-
CiscoFirepower 4140-
CiscoFirepower 4145-
CiscoFirepower 4150-
CiscoFirepower 9300-
CiscoNx-Os< 6.2\(7\)
CiscoMds 9100-
CiscoMds 9200-
CiscoMds 9500-
CiscoMds 9700-
CiscoNexus 3016-
CiscoNexus 3048-
CiscoNexus 3064-
CiscoNexus 3064-T-
CiscoNexus 31108Pc-V-

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2019-1734?

CVE-2019-1734 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that shoul...

How severe is CVE-2019-1734?

CVE-2019-1734 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-1734?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Extensible Operating System, Cisco Firepower 4110, Cisco Firepower 4112, Cisco Firepower 4115, Cisco Firepower 4120.