CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1656 – Cisco Enterprise NFV Infrastructure Software Linux Shell Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-1656
24 Jan 2019 — A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An attacker could exploit this vulnerability by sending crafted commands to the affected device. An exploit could allow the attacker to gain shell access with a nonroot user account to the underlying Linux operating sys... • http://www.securityfocus.com/bid/106715 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 3%CPEs: 2EXPL: 0CVE-2018-0279
https://notcve.org/view.php?id=CVE-2018-0279
17 May 2018 — A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation of command arguments. An attacker could exploit this vulnerability by using crafted arguments when opening a connection to the affected device. An exploit could allow the attacker to gain shell access with a non-ro... • http://www.securityfocus.com/bid/104243 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •