{"id":"CVE-2025-20161","published":"2025-02-26T16:12:03Z","modified":"2025-02-27T15:18:00Z","title":"Cisco NX-OS Software Command Injection Vulnerability","vendor":"Cisco","product":"Cisco NX-OS Software","tier":"tail","description":{"text":"A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of specific elements within a software image. An attacker could exploit this vulnerability by installing a crafted image. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. \r\nNote: Administrators should validate the hash of any software image before installation.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00497,"percentile":0.42481,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ici-dpOjbWxk","tags":[]}],"priority":{"score":12.1,"factors":[{"name":"EPSS percentile","points":8.5},{"name":"CVSS severity","points":3.57}]},"vendorSlug":"cisco","affectedVersions":[{"vendor":"Cisco","product":"Cisco NX-OS Software","versions":["9.2(3)","7.0(3)I5(2)","6.0(2)A8(7a)","7.0(3)I4(5)","7.0(3)I4(6)","7.0(3)I4(3)","9.2(2v)","7.0(3)I4(7)","7.0(3)I4(1)","7.0(3)I4(8)"]}],"euvd":{"id":"EUVD-2025-5296","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-cisco-nx-os-cwe-78"}}