1. Home
  2. CVE Database
  3. CVE-2019-1804
CRITICAL · 9.8

CVE-2019-1804

A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to th...

Vulnerability Description

A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The vulnerability is due to the presence of a default SSH key pair that is present in all devices. An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user. This vulnerability is only exploitable over IPv6; IPv4 is not vulnerable.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoNexus 9332Pq Firmware14.0\(3d\)
CiscoNexus 9332Pq-
CiscoNexus 93180Yc-Ex Firmware14.0\(3d\)
CiscoNexus 93180Yc-Ex-
CiscoNexus 93128Tx Firmware14.0\(3d\)
CiscoNexus 93128Tx-
CiscoNexus 93120Tx Firmware14.0\(3d\)
CiscoNexus 93120Tx-
CiscoNexus 93108Tc-Ex Firmware14.0\(3d\)
CiscoNexus 93108Tc-Ex-
CiscoNexus 9516 Firmware14.0\(3d\)
CiscoNexus 9516-
CiscoNexus 9508 Firmware14.0\(3d\)
CiscoNexus 9508-
CiscoNexus 9504 Firmware14.0\(3d\)
CiscoNexus 9504-
CiscoNexus 9500 Firmware14.0\(3d\)
CiscoNexus 9500-
CiscoNexus 9396Tx Firmware14.0\(3d\)
CiscoNexus 9396Tx-

Related Weaknesses (CWE)

CWE-1188CWE-310

References

FAQ

What is CVE-2019-1804?

CVE-2019-1804 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to th...

How severe is CVE-2019-1804?

CVE-2019-1804 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-1804?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nexus 9332Pq Firmware, Cisco Nexus 9332Pq, Cisco Nexus 93180Yc-Ex Firmware, Cisco Nexus 93180Yc-Ex, Cisco Nexus 93128Tx Firmware.