Vulnerability identifier: #VU780

Vulnerability risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-0721

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco MDS 9000 Series Multilayer Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 9000 Series Switches NX-OS Mode
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 6000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 5600 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 5000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 2000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 4000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Nexus 3500 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 3000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 1000 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Nexus 7700 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Cisco Systems, Inc

Description
The vulnerability allows a remote authenticated user to bypass authentication, authorization, and accounting (AAA) limitations.
The weakness exists due to incorrect handling of parameters passed during negotiation of an SSH connection. Attackers will manage to pass a malicious value as a part of login procedure that allows to bypass AAA restrictions and execute arbitrary commands.
Successful exploitation of the vulnerability results in AAA bypass and access to the vulnerable system.

Mitigation
Update Cisco Nexus 1000 to 5.2(1)SV3(1.15).
Update Cisco Nexus 3000 to 6.0(2)U6(7) or 7.0(3)I4(1).
Update Cisco Nexus 3500 to 6.0(2)A8(1).
Update Cisco Nexus 4000 to 4.1(2)E1(1p).
Update Cisco Nexus 5000 to 5.2(1)N1(9a).

Update Cisco Nexus 2000, 5500, 5600 and 6000 to 7.1(4)N1(1) , 7.2(2)N1(1) or 7.3(0)N1(1).
Update Cisco Nexus 7000 and 7700 to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches NX-OS Mode to 7.0(3)I4(1).
Update Cisco MDS 9000 Series Multilayer Switches to 6.2(15) or 7.3(0)D1(1).

Vulnerable software versions

Cisco MDS 9000 Series Multilayer Switches: 5.2 - 7.3

Cisco Nexus 9000 Series Switches NX-OS Mode: 6.1 - 7.0

Cisco Nexus 6000 Series Switches: 5.2 - 7.3

Cisco Nexus 5600 Series Switches: 5.2 - 7.3

Cisco Nexus 5000 Series Switches: 5.1 - 7.3

Cisco Nexus 2000 Series Switches: 5.2 - 7.3

Cisco Nexus 4000 Series Switches: 4.1

Nexus 3500 Series Switches: 5.0 - 6.0

Cisco Nexus 3000 Series Switches: 6.0 - 7.0

Cisco Nexus 1000 Series Switches: 4.2 - 5.2

Cisco Nexus 7700 Series Switches: 5.0 - 7.3

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.