The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and…
Priority LOW 30CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for VMware vSphere, Cisco Nexus 1000V switch 5.2(1)SM1(5.1) for Microsoft Hyper-V, and Cisco Virtual Security Gateway 4.2(1)VSG1(1) for Nexus 1000V switches allows local users to gain privileges and execute arbitrary commands via crafted "install all iso" arguments, aka Bug ID CSCui21340.
Why it matters now
EPSS 0.00315 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)vsg1\(1\):-:*:*:*:nexus_1000v:*:* | 4.2(1)vsg1(1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:5.2\(1\)sm1\(5.1\):-:*:*:*:microsoft_hyper-v:*:* | 5.2(1)sm1(5.1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:*:-:*:*:*:vmware_vsphere:*:* | up to 4.2\(1\)sv1\(5.2b\) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)_sv1(4) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4a\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)_sv1(4a) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4b\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)_sv1(4b) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)sv1(5.1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1a\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)sv1(5.1a) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.2\):-:*:*:*:vmware_vsphere:*:* | 4.2(1)sv1(5.2) | Vulnerable | Cisco |
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)vsg1\(1\):-:*:*:*:nexus_1000v:*:* Versions 4.2(1)vsg1(1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:5.2\(1\)sm1\(5.1\):-:*:*:*:microsoft_hyper-v:*:* Versions 5.2(1)sm1(5.1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:*:-:*:*:*:vmware_vsphere:*:* Versions up to 4.2\(1\)sv1\(5.2b\) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)_sv1(4) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4a\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)_sv1(4a) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4b\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)_sv1(4b) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)sv1(5.1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1a\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)sv1(5.1a) Vulnerable ·Cisco
- cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.2\):-:*:*:*:vmware_vsphere:*:* Versions 4.2(1)sv1(5.2) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-5556
- 2026-10-03 Alias added: GHSA-269h-2wf7-8247
References
More Cisco Nexus 1000v vulnerabilities
- TI-2013-01024 Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco… CVSS 2.0HIGH 8.3
- TI-2012-00326 Cisco NX-OS 4.2.x before 4.2(1)SV1(5.1) on Nexus 1000v series switches; 4.x and 5.0.x… CVSS 2.0HIGH 7.8
- TI-2013-02967 The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users… CVSS 2.0MEDIUM 6.8
- TI-2015-00723 The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices… CVSS 2.0MEDIUM 5.0
- TI-2013-01055 The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509… CVSS 2.0MEDIUM 5.8
- TI-2013-01056 Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2013-5556 · CVE Program
- CVE-2013-5556 · NVD
- FIRST EPSS
- GHSA-269h-2wf7-8247 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences