Cisco has disclosed a critical vulnerability CVE-2024-20399 in its NX-OS Software that could allow an authenticated, local attacker to execute arbitrary commands as root user permissions on the operating system of an affected devices.
Understanding the Vulnerability
Cisco recently discovered a security flaw in the Command Line Interface (CLI) of its NX-OS Software. This vulnerability could potentially allow an authenticated, local attacker to execute arbitrary commands with root privileges on affected devices. The root cause is Insufficient validation of arguments passed to specific configuration CLI commands.
Affected Products
The CVE-2024-20399 vulnerability impacts various Cisco products running vulnerable releases of NX-OS Software, including:
- MDS 9000 Series Multilayer Switches
- Nexus 3000 Series Switches
- Nexus 5500 Platform Switches
- Nexus 5600 Platform Switches
- Nexus 6000 Series Switches
- Nexus 7000 Series Switches
- Nexus 9000 Series SwitchesIf an attacker is able to exploit this vulnerability, they could gain unauthorized access to the underlying operating system of an affected device. This could allow them to execute arbitrary commands, potentially leading to a complete compromise of the device and the network it is connected to.
To prevent this vulnerability from being exploited, network administrators should always make sure that all running devices and appliances are running the latest software releases.
