PT-2024-3821 · Cisco · Cisco Nexus Dashboard

Cooper Timewell · Published 2024-04-03 · Updated 2025-05-07 · CVE-2024-20282

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard (affected versions not specified)

Description The issue is related to insufficient access control protections, which could allow an authenticated, local attacker with valid credentials to elevate privileges to root on an affected device. This is due to inadequate protections for a sensitive access token, which an attacker could exploit to access resources within the device infrastructure, potentially gaining root access to the filesystem or hosted containers.

Recommendations For all affected versions, consider restricting access to sensitive resources and tokens until a patch is available. As a temporary workaround, limit the use of rescue-user credentials to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Insufficiently Protected Credentials

Weakness Enumeration

CWE-269

CWE-522

Related Identifiers

BDU:2024-04197

CVE-2024-20282

Affected Products

Cisco Nexus Dashboard

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-20282 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndru-pesc-kZ2PQLZH · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04197 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20282 · Vendor Advisory
• https://t.me/cvenotify/121212 · Telegram Post