What’s Vulnerable › Vulnerabilities

CVE-2019-12662: Cisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass Vulnerability

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-25 · updated 2026-06-17
• Weakness: CWE-347

Description

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper signature verification during the installation of an Open Virtual Appliance (OVA) image. An authenticated, local attacker could exploit this vulnerability and load a malicious, unsigned OVA image on an affected device. A successful exploit could allow an attacker to perform code execution on a crafted software OVA image.

Affected products

• Cisco IOS XE: 16.8.1
• Cisco Nexus 3016 Firmware: all versions
• Cisco Nexus 3048 Firmware: all versions
• Cisco Nexus 3064-T Firmware: all versions
• Cisco Nexus 3064 Firmware: all versions
• Cisco Nexus 31108Pc-V Firmware: all versions
• Cisco Nexus 31108Tc-V Firmware: all versions
• Cisco Nexus 31128Pq Firmware: all versions
• Cisco Nexus 3132C-Z Firmware: all versions
• Cisco Nexus 3132Q-V Firmware: all versions
• Cisco Nexus 3132Q-Xl Firmware: all versions
• Cisco Nexus 3132Q Firmware: all versions
• Cisco Nexus 3164Q Firmware: all versions
• Cisco Nexus 3172 Firmware: all versions
• Cisco Nexus 3172Pq-Xl Firmware: all versions
• Cisco Nexus 3172Tq-32T Firmware: all versions
• Cisco Nexus 3172Tq-Xl Firmware: all versions
• Cisco Nexus 3172Tq Firmware: all versions
• Cisco Nexus 3232C Firmware: all versions
• Cisco Nexus 3264C-E Firmware: all versions
• Cisco Nexus 3264Q Firmware: all versions
• Cisco Nexus 3408-S Firmware: all versions
• Cisco Nexus 34180Yc Firmware: all versions
• Cisco Nexus 34200Yc-Sm Firmware: all versions
• Cisco Nexus 3432D-S Firmware: all versions
• Cisco Nexus 3464C Firmware: all versions
• Cisco Nexus 3524-X Firmware: all versions
• Cisco Nexus 3524-Xl Firmware: all versions
• Cisco Nexus 3524 Firmware: all versions
• Cisco Nexus 3548-X Firmware: all versions

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-vman
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-vman

Get alerted when CVE-2019-12662 or the next vulnerability affects your stack