CVE-2018-0092: A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allo...

Security readout for executives and security teams

A user with Cisco NX-OS network-operator privileges may be able to delete other configured user accounts, which should be outside that role's authority. This is not an unauthenticated internet attack; the attacker needs valid device credentials. Business risk is disruption of administrative access and loss of device-account integrity on affected Nexus platforms. Exposure is limited to affected Cisco Nexus devices running NX-OS where an attacker can authenticate with network-operator role credentials. Environments with shared operator accounts, weak AAA controls, or broad device-login access face higher practical risk. Treat as a targeted access-control risk, not an emergency internet-wide exposure. Prioritize devices supporting critical network paths and environments where many staff or service accounts hold network-operator access. Mitigation focus: Review Cisco advisory cisco-sa-20180117-nxos1 for fixed releases and vendor guidance.; Upgrade affected NX-OS deployments according to Cisco guidance where applicable.; Limit network-operator role assignment to named, necessary users only..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.