Read the docs
TI-2019-01227 Aliases CVE-2019-1600GHSA-jxp7-39vp-v468

Cisco FXOS and NX-OS Software Unauthorized Directory Access Vulnerability

Priority LOW 23CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive information that is stored in the file system of an affected system. The vulnerability is due to improper implementation of file system permissions. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow the attacker to access sensitive and critical files. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. Firepower 9300 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25), 8.1(1b), and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed Firepower 4100 Series Next-Generation Firewalls (Cisco): 2.2.2.91, 2.3.1.110Firepower 9300 Series Next-Generation Firewalls (Cisco): 2.2.2.91, 2.3.1.110+8 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoFirepower 4100 Series Next-Generation Firewallsbefore 2.2.2.91; before 2.3.1.1102.2.2.91, 2.3.1.110Patch availableCNA
CiscoFirepower 9300 Series Next-Generation Firewallsbefore 2.2.2.91; before 2.3.1.1102.2.2.91, 2.3.1.110Patch availableCNA
CiscoMDS 9000 Series Multilayer Switchesbefore 6.2(25); before 8.1(1b); before 8.3(1)6.2(25), 8.1(1b), 8.3(1)Patch availableCNA
CiscoNexus 3000 Series Switchesbefore 7.0(3)I4(9); before 7.0(3)I7(4)7.0(3)I4(9), 7.0(3)I7(4)Patch availableCNA
CiscoNexus 3500 Platform Switchesbefore 6.0(2)A8(10); before 7.0(3)I7(4)6.0(2)A8(10), 7.0(3)I7(4)Patch availableCNA
CiscoNexus 3600 Platform Switchesbefore 7.0(3)F3(5)7.0(3)F3(5)Patch availableCNA
CiscoNexus 2000, 5500, 5600, and 6000 Series Switchesbefore 7.1(5)N1(1b); before 7.3(3)N1(1)7.1(5)N1(1b), 7.3(3)N1(1)Patch availableCNA
CiscoNexus 7000 and 7700 Series Switchesbefore 6.2(22); before 7.3(3)D1(1); before 8.2(3)6.2(22), 7.3(3)D1(1), 8.2(3)Patch availableCNA
CiscoNexus 9000 Series Switches-Standalonebefore 7.0(3)I4(9); before 7.0(3)I7(4)7.0(3)I4(9), 7.0(3)I7(4)Patch availableCNA
CiscoNexus 9500 R-Series Line Cards and Fabric Modulesbefore 7.0(3)F3(5)7.0(3)F3(5)Patch availableCNA
  • Firepower 4100 Series Next-Generation Firewalls VendorCisco Affected before 2.2.2.91; before 2.3.1.110 Fixed in 2.2.2.91, 2.3.1.110 Patch available CNA
  • Firepower 9300 Series Next-Generation Firewalls VendorCisco Affected before 2.2.2.91; before 2.3.1.110 Fixed in 2.2.2.91, 2.3.1.110 Patch available CNA
  • MDS 9000 Series Multilayer Switches VendorCisco Affected before 6.2(25); before 8.1(1b); before 8.3(1) Fixed in 6.2(25), 8.1(1b), 8.3(1) Patch available CNA
  • Nexus 3000 Series Switches VendorCisco Affected before 7.0(3)I4(9); before 7.0(3)I7(4) Fixed in 7.0(3)I4(9), 7.0(3)I7(4) Patch available CNA
  • Nexus 3500 Platform Switches VendorCisco Affected before 6.0(2)A8(10); before 7.0(3)I7(4) Fixed in 6.0(2)A8(10), 7.0(3)I7(4) Patch available CNA
  • Nexus 3600 Platform Switches VendorCisco Affected before 7.0(3)F3(5) Fixed in 7.0(3)F3(5) Patch available CNA
  • Nexus 2000, 5500, 5600, and 6000 Series Switches VendorCisco Affected before 7.1(5)N1(1b); before 7.3(3)N1(1) Fixed in 7.1(5)N1(1b), 7.3(3)N1(1) Patch available CNA
  • Nexus 7000 and 7700 Series Switches VendorCisco Affected before 6.2(22); before 7.3(3)D1(1); before 8.2(3) Fixed in 6.2(22), 7.3(3)D1(1), 8.2(3) Patch available CNA
  • Nexus 9000 Series Switches-Standalone VendorCisco Affected before 7.0(3)I4(9); before 7.0(3)I7(4) Fixed in 7.0(3)I4(9), 7.0(3)I7(4) Patch available CNA
  • Nexus 9500 R-Series Line Cards and Fabric Modules VendorCisco Affected before 7.0(3)F3(5) Fixed in 7.0(3)F3(5) Patch available CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*1.1 to before 2.2.2.91; 2.3 to before 2.3.1.110VulnerableCisco
cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*8.2 to before 8.3\(1\)VulnerableCisco
cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.0\(3\)i5 to before 7.0\(3\)i7\(4\)VulnerableCisco
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.0\(3\) to before 7.0\(3\)i7\(4\)VulnerableCisco
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.0\(3\)f3 to before 7.0\(3\)f3\(5\)VulnerableCisco
  • cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* Versions 1.1 to before 2.2.2.91; 2.3 to before 2.3.1.110 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 8.2 to before 8.3\(1\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.0\(3\)i5 to before 7.0\(3\)i7\(4\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.0\(3\) to before 7.0\(3\)i7\(4\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.0\(3\)f3 to before 7.0\(3\)f3\(5\) Vulnerable ·Cisco
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.2 to before 7.3\(3\)n1\(1\)VulnerableCisco
cpe:2.3:h:cisco:nexus_2000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*8.0 to before 8.2\(3\)VulnerableCisco
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.0\(3\)f1 to before 7.0\(3\)f3\(5\)VulnerableCisco
cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*7.3 to before 8.1\(1b\); 5.2. to before 6.2\(25\); before 7.0\(3\)i4\(9\); before 6.0\(2\)a8\(10\); before 7.1\(5\)n1\(1b\); 7.2 to before 7.3\(3\)d1\(1\); before 6.2\(22\)VulnerableCisco
  • cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.2 to before 7.3\(3\)n1\(1\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_2000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 8.0 to before 8.2\(3\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.0\(3\)f1 to before 7.0\(3\)f3\(5\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions 7.3 to before 8.1\(1b\); 5.2. to before 6.2\(25\); before 7.0\(3\)i4\(9\); before 6.0\(2\)a8\(10\); before 7.1\(5\)n1\(1b\); 7.2 to before 7.3\(3\)d1\(1\); before 6.2\(22\) Vulnerable ·Cisco

Remediation

  • Fix · CNA Firepower 4100 Series Next-Generation Firewalls (Cisco) Fixed in 2.2.2.91, 2.3.1.110
  • Fix · CNA Firepower 9300 Series Next-Generation Firewalls (Cisco) Fixed in 2.2.2.91, 2.3.1.110
  • Fix · CNA MDS 9000 Series Multilayer Switches (Cisco) Fixed in 6.2(25), 8.1(1b), 8.3(1)
  • Fix · CNA Nexus 3000 Series Switches (Cisco) Fixed in 7.0(3)I4(9), 7.0(3)I7(4)
  • Fix · CNA Nexus 3500 Platform Switches (Cisco) Fixed in 6.0(2)A8(10), 7.0(3)I7(4)
  • Fix · CNA Nexus 3600 Platform Switches (Cisco) Fixed in 7.0(3)F3(5)
  • Fix · CNA Nexus 2000, 5500, 5600, and 6000 Series Switches (Cisco) Fixed in 7.1(5)N1(1b), 7.3(3)N1(1)
  • Fix · CNA Nexus 7000 and 7700 Series Switches (Cisco) Fixed in 6.2(22), 7.3(3)D1(1), 8.2(3)
  • Fix · CNA Nexus 9000 Series Switches-Standalone (Cisco) Fixed in 7.0(3)I4(9), 7.0(3)I7(4)
  • Fix · CNA Nexus 9500 R-Series Line Cards and Fabric Modules (Cisco) Fixed in 7.0(3)F3(5)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Nexus 3600 Platform Switches, Nexus 9500 R-Series Line Cards and Fabric Modules 7.0(3)F3(5)

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-01223 Cisco NX-OS Software Bash Shell Privilege Escalation VulnerabilityPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1600
  2. 2026-10-03 Alias added: GHSA-jxp7-39vp-v468

References

Patch 1

  • TI-2018-00269 Resource management flaw in Cisco FXOS and NX-OS unknown CVSS 3.0CRITICAL 9.8
  • TI-2015-05417 An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco… CVSS 3.0CRITICAL 9.8
  • TI-2019-01480 Cisco FXOS and NX-OS Software Simple Network Management Protocol Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2019-01225 Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities CVSS 3.0HIGH 8.6
  • TI-2019-01224 Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities CVSS 3.0HIGH 8.6
  • TI-2020-03063 Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability CVSS 3.1HIGH 8.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences