CVE-2019-1618

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to an incorrect permissions setting. An attacker could exploit this vulnerability by replacing valid agent files with malicious code. A successful exploit could result in the execution of code supplied by the attacker. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running versions prior to 7.0(3)I7(5).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-161805.3Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method iCVE-2019-161812.7In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.CVE-2019-161826.1A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitraryCVE-2019-161832.7In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.CVE-2019-161849.8A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey resCVE-2019-161857.2In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.CVE-2019-161867.2In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.CVE-2019-161877.5Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-sCVE-2019-161887.1HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can CVE-2019-16199.8A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attCVE-2019-161909.8SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows AuthentCVE-2019-161929.8upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code throug
CVE-2019-1618: High severity, CVSS 7.8 | Vulnix