What is CVE-2019-12662?

CVE-2019-12662 is a medium-severity vulnerability in Cisco Nx-Os Software 6.0(2)a1(1), classified under Improper Verification of Cryptographic Signature. CVSS score: 6.7/10. Published 2019-09-25.

How severe is CVE-2019-12662?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Vulnerability in Cisco Nx-Os Software 6.0(2)a1(1)

CVE-2019-12662

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper signature verification during the installation of an Open Virtual Appliance (OVA) image. An authenticated, local attacker could exploit this vulnerability and load a malicious, unsigned OVA image on an affected device. A successful exploit could allow an attacker to perform code execution on a crafted software OVA image.

EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Nx-os Software 6.0(2)a1(1) — versions unspecified
Cisco Ios_xe — versions 16.8.1
Cisco Mds_9000
Cisco Nexus_3016
Cisco Nexus_3016_firmware
Cisco Nexus_3048
Cisco Nexus_3048_firmware
Cisco Nexus_3064
Cisco Nexus_3064_firmware
Cisco Nexus_3064-t

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2019-12662?: CVE-2019-12662 is a medium-severity vulnerability in Cisco Nx-Os Software 6.0(2)a1(1), classified under Improper Verification of Cryptographic Signature. CVSS score: 6.7/10. Published 2019-09-25.
How severe is CVE-2019-12662?: Medium severity. CVSS v3 base score is 6.7 out of 10.