Product: Cisco NX-OS Software
Summary
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an affected device. This vulnerability arises from insufficient validation of user-supplied input. An attacker with valid user credentials could exploit this vulnerability to read and write files on the underlying operating system with the privileges of a non-root user account.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2025-20292 |
Exploitation
To exploit this vulnerability, an attacker must have valid user credentials on the affected device. By entering crafted input as an argument to an affected CLI command, the attacker can execute commands that allow them to read and write files on the underlying operating system, limited to the permissions of the non-root user account.
Affected Products
- Cisco NX-OS Software: Affected versions may allow command injection through the CLI, enabling unauthorized file access.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper input validation and limit user access to the CLI. Regularly updating the software and monitoring user activities can also help in reducing the risk of exploitation.