Test ID:	1.3.6.1.4.1.25623.1.0.105708
Category:	CISCO
Title:	Cisco NX-OS Software DHCP Options Command Injection Vulnerability (Cisco-SA-20150327-CVE-2015-0658)
Summary:	A vulnerability in DHCP code used with PowerOn Auto; Provisioning (POAP) of Cisco NX-OS could allow an unauthenticated, adjacent attacker to inject; arbitrary commands into the Cisco NX-OS device.
Description:	Summary: A vulnerability in DHCP code used with PowerOn Auto Provisioning (POAP) of Cisco NX-OS could allow an unauthenticated, adjacent attacker to inject arbitrary commands into the Cisco NX-OS device. Vulnerability Insight: The vulnerability is due to insufficient input validation of the DHCP options returned as a result of POAP. An attacker could exploit this vulnerability by responding to the initial DHCP request initiated as part of POAP with crafted DHCP packets. Vulnerability Impact: An exploit could allow the attacker to execute arbitrary commands in the security context of the root user. The attack can occur during the POAP initialization process. Solution: See the referenced vendor advisory for a solution. CVSS Score: 7.9 CVSS Vector: AV:A/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-0658 Cisco Security Advisory: 20150327 Cisco NX-OS Software DHCP Options Command Injection Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=38062 http://www.securitytracker.com/id/1031992
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.