Cisco NX-OS: CVE-2024-20289: Cisco NX-OS Software Command Injection Vulnerability

Cisco NX-OS: CVE-2024-20289: Cisco NX-OS Software Command Injection Vulnerability

Severity

3

CVSS

(AV:L/AC:L/Au:S/C:P/I:P/A:N)

Published

08/28/2024

Created

09/06/2024

Added

09/04/2024

Modified

11/22/2024

Description

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments for a specific CLI command. An attacker could exploit this vulnerability by including crafted input as the argument of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.

Solution(s)

• cisco-nx-update-latest

References

• https://attackerkb.com/topics/cve-2024-20289
• CVE - 2024-20289
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-Lq6jsZhH
• cisco-sa-nxos-cmdinj-Lq6jsZhH