CVE-2019-1732 – Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability

https://notcve.org/view.php?id=CVE-2019-1732

15 May 2019 — A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected devi... • http://www.securityfocus.com/bid/108361 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-667: Improper Locking •