This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Cisco NX-OS fixes an actively exploited command injection vulnerability

Cisco has released firmware updates for Nexus switches that fix a vulnerability allowing command injection into the underlying NX-OS.

Cisco NX-OS - command injection (CVE-2024-20399)
CVSS 6.0 (Medium)

An authenticated local attacker is allowed, by means of specially crafted parameters of configuration commands in the CLI, to execute commands in the underlying NX-OS with elevated privileges (root) [1]. The attack thus allows escaping from the CLI [2] and requires administrator privileges [1]. Technical details are in the vendor's security advisory [2] and in the finder's description [3]. The vulnerability is actively exploited [3], which led to its identification, so it was a 0day. The vulnerability fully affects Nexus 5500, 5600, 6000 switches [2]. It further affects Nexus 3000, 7000, 9000 (with NX-OS) and MDS 9000 (multilayer), where the ability to execute commands in the underlying OS is available by default, but when the vulnerability is exploited the executed commands are not logged.

The vulnerability is present in product:

  • cisco nx-os;<6.2,<=6.2.24a;>7.2,<=7.2.2.d1.2;>7.3,<7.3.9.d1.1;>8.0,<=8.4

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X

More information:

The vulnerability was publicly disclosed 1. 7. 2024.

CESNET, z.s.p.o. on 11. 7. 2024.

CESNET, z.s.p.o. Logo