Cisco Nexus Dashboard Fabric Controller AMF Deserialization of Untrusted Data Remote Code Execution Vulnerability

March 11th, 2022
ZDI-22-506 ZDI-CAN-14805

CVE ID

CVE-2017-5641

CVSS Score

7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected Vendors

Cisco

Affected Products

Nexus Dashboard Fabric Controller

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the AMF protocol. Crafted data in an AMF protocol message can trigger the deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the fmserver user.

Additional Details

Fixed in version 11.5(4) or later


Disclosure Timeline

  • 2021-09-10 - Vulnerability reported to vendor
  • 2022-03-11 - Coordinated public release of advisory

Credit

Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) from Agile Information Security

Back to Advisories