Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal Vulnerability

published 2019-05-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10393

cvss: 5.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to use symbolic links to overwrite system files. These system files may be sensitive and should not be overwritable by non-root users. The attacker would need valid device credentials. The vulnerability is due to incorrect symbolic link verification of directory paths when they are used in the system shell. An attacker could exploit this vulnerability by authenticating to the device and providing crafted user input to specific symbolic link CLI commands. Successful exploitation could allow the attacker to overwrite system files that should be restricted. This vulnerability has been fixed in software version 14.1(1i).

Patch / fix

fixed in 1

Cisco Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode 14.1(1i)

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago (2024-11-21)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD	2.0	6.6	AV:L/AC:L/Au:N/C:N/I:C/A:C

Affected products

Cisco Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-59 Improper Link Resolution Before File Access

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-fabric-traversal
vendor-advisory
securityfocus.com /bid/108150
vdb-entry, third-party-advisory

Sources

CVE List CVE-2019-1836
NVD CVE-2019-1836

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary