Description
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.
Problem types
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Product status
11.2(1)
7.0(2)
10.3(2)IPFM
10.1(1)
7.2(3)
7.2(2)
7.2(1)
11.0(1)
10.4(1)
10.2(1)
7.2(2a)
10.1(2)
7.1(1)
12.1(1)
11.1(1)
10.3(1)
10.3(1)R(1)
7.0(1)
10.0(1)
7.1(2)
11.4(1)
10.4(2)
11.3(1)
11.5(1)
11.5(2)
11.5(3)
12.0.1a
11.5(3a)
12.0.2d
12.0.2f
11.5(4)
12.1.1
12.1.1e
12.1.1p
12.1.2e
12.1.2p
12.1.3b
12.2.1
References
sec.cloudapps.cisco.com/...isory/cisco-sa-ndfc-raci-T46k3jnN (cisco-sa-ndfc-raci-T46k3jnN)
