CVE-2015-0658

Published: Mar 28, 2015Modified: May 6, 2026

7.9

Vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 5.5 / Impact: 10.0

Source: NVD

Description

The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Affected (68)

Products: Cisco: Nx Os

Cisco

1 product

Nx Os

Configuration A

11 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Version 6.1(2)
Cisco Nx Os	Version 6.1(3)
Cisco Nx Os	Version 6.1(4)
Cisco Nx Os	Version 6.1(4a)
Cisco Nx Os	Version 6.2(2)
Cisco Nx Os	Version 6.2(2a)
Cisco Nx Os	Version 6.2(6)
Cisco Nx Os	Version 6.2(6b)
Cisco Nx Os	Version 6.2(8)
Cisco Nx Os	Version 6.2(8a)
Cisco Nx Os	Version 6.2(8b)

Running on/with	Platform Versions
Cisco Nexus 7000	All versions
Cisco Nexus 7700	All versions

Configuration B

1 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Version 6.0(2)n1(1)

Running on/with	Platform Versions
Cisco Nexus 5010	All versions
Cisco Nexus 5020	All versions
Cisco Nexus 5548p	All versions
Cisco Nexus 5548up	All versions
Cisco Nexus 5596t	All versions
Cisco Nexus 5596up	All versions
Cisco Nexus 56128p	All versions
Cisco Nexus 5624q	All versions
Cisco Nexus 5648q	All versions
Cisco Nexus 5672up	All versions
Cisco Nexus 5696q	All versions

Configuration C

12 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Version 6.0(2)n1(2)
Cisco Nx Os	Version 6.0(2)n1(2a)
Cisco Nx Os	Version 6.0(2)n2(1)
Cisco Nx Os	Version 6.0(2)n2(1b)
Cisco Nx Os	Version 6.0(2)n2(2)
Cisco Nx Os	Version 6.0(2)n2(3)
Cisco Nx Os	Version 6.0(2)n2(4)
Cisco Nx Os	Version 6.0(2)n2(5)
Cisco Nx Os	Version 7.0(0)n1(1)
Cisco Nx Os	Version 7.0(1)n1(1)
Cisco Nx Os	Version 7.0(2)n1(1)
Cisco Nx Os	Version 7.0(3)n1(1)

Running on/with	Platform Versions
Cisco Nexus 6001	All versions
Cisco Nexus 6004	All versions

Configuration D

10 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Version 11.0(1b)
Cisco Nx Os	Version 11.0(1c)
Cisco Nx Os	Version 6.1(2)i2(1)
Cisco Nx Os	Version 6.1(2)i2(2)
Cisco Nx Os	Version 6.1(2)i2(2a)
Cisco Nx Os	Version 6.1(2)i2(2b)
Cisco Nx Os	Version 6.1(2)i2(3)
Cisco Nx Os	Version 6.1(2)i3(1)
Cisco Nx Os	Version 6.1(2)i3(2)
Cisco Nx Os	Version 6.1(2)i3(3)

Running on/with	Platform Versions
Cisco Nexus 93120tx	All versions
Cisco Nexus 93128tx	All versions
Cisco Nexus 9332pq	All versions
Cisco Nexus 9336pq Aci Spine	All versions
Cisco Nexus 9372px	All versions
Cisco Nexus 9372tx	All versions
Cisco Nexus 9396px	All versions
Cisco Nexus 9396tx	All versions
Cisco Nexus 9504	All versions
Cisco Nexus 9508	All versions
Cisco Nexus 9516	All versions

Configuration E

34 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Version 5.0(3)u3(1)
Cisco Nx Os	Version 5.0(3)u3(2)
Cisco Nx Os	Version 5.0(3)u3(2a)
Cisco Nx Os	Version 5.0(3)u3(2b)
Cisco Nx Os	Version 5.0(3)u4(1)
Cisco Nx Os	Version 5.0(3)u5(1)
Cisco Nx Os	Version 5.0(3)u5(1a)
Cisco Nx Os	Version 5.0(3)u5(1b)
Cisco Nx Os	Version 5.0(3)u5(1c)
Cisco Nx Os	Version 5.0(3)u5(1d)
Cisco Nx Os	Version 5.0(3)u5(1e)
Cisco Nx Os	Version 5.0(3)u5(1f)
Cisco Nx Os	Version 5.0(3)u5(1g)
Cisco Nx Os	Version 5.0(3)u5(1h)
Cisco Nx Os	Version 6.0(2)u1(1)
Cisco Nx Os	Version 6.0(2)u1(1a)
Cisco Nx Os	Version 6.0(2)u1(2)
Cisco Nx Os	Version 6.0(2)u1(3)
Cisco Nx Os	Version 6.0(2)u1(4)
Cisco Nx Os	Version 6.0(2)u2(1)
Cisco Nx Os	Version 6.0(2)u2(2)
Cisco Nx Os	Version 6.0(2)u2(3)
Cisco Nx Os	Version 6.0(2)u2(4)
Cisco Nx Os	Version 6.0(2)u2(5)
Cisco Nx Os	Version 6.0(2)u2(6)
Cisco Nx Os	Version 6.0(2)u3(1)
Cisco Nx Os	Version 6.0(2)u3(2)
Cisco Nx Os	Version 6.0(2)u3(3)
Cisco Nx Os	Version 6.0(2)u3(4)
Cisco Nx Os	Version 6.0(2)u3(5)
Cisco Nx Os	Version 6.0(2)u4(1)
Cisco Nx Os	Version 6.0(2)u4(2)
Cisco Nx Os	Version 6.0(2)u4(3)
Cisco Nx Os	Version 6.0(2)u5(1)

Running on/with	Platform Versions
Cisco Nexus 3016	All versions
Cisco Nexus 3048	All versions
Cisco Nexus 3064	All versions
Cisco Nexus 3132q	All versions
Cisco Nexus 3164q	All versions
Cisco Nexus 3172	All versions
Cisco Nexus 3524	All versions
Cisco Nexus 3548	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://tools.cisco.com/security/center/viewAlert.x?alertId=38062

Source: psirt@cisco.com

Vendor Advisory

http://www.securitytracker.com/id/1031992

Source: psirt@cisco.com

http://tools.cisco.com/security/center/viewAlert.x?alertId=38062

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securitytracker.com/id/1031992

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.