PT-2024-6113 · Cisco · Cisco Nx-Os+1

Published 2024-08-11 · Updated 2024-08-29 · CVE-2024-20413

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description The issue is related to insufficient security restrictions when executing application arguments from the Bash shell, allowing an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-admin on an affected device. An attacker could exploit this by executing crafted commands on the underlying operating system, potentially creating new users with network-admin privileges.

Recommendations For Cisco NX-OS Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-07027

CVE-2024-20413

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-20413 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-bshacepe-bApeHSx7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07027 · Security Note
• https://t.me/cvenotify/92527 · Telegram Post
• https://t.me/cvedetector/4342 · Telegram Post
• https://vuldb.com/ru/?id.276010 · Note
• https://twitter.com/CVESource/status/1828849458194325992 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1828873802362548644 · Twitter Post
• https://twitter.com/CVEnew/status/1828836208815779928 · Twitter Post