PT-2024-6117 · Cisco · Cisco Nx-Os+1

Published 2024-08-28 · Updated 2024-08-29 · CVE-2024-20411

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description The issue is related to insufficient security restrictions when executing commands from the Bash shell, allowing an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as root on an affected device. An attacker could exploit this by executing a specific crafted command on the underlying operating system, potentially allowing the execution of arbitrary code with root privileges.

Recommendations For Cisco NX-OS Software, consider applying the software updates released by Cisco that address this issue. As a temporary workaround, restrict access to the Bash shell to minimize the risk of exploitation. Avoid using the Bash shell for executing commands that could potentially exploit this issue until the software updates are applied. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but software updates have been released by Cisco.

Fix

Weakness Enumeration

CWE-267

Related Identifiers

BDU:2024-07031

CVE-2024-20411

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-20411 · Security Note
• https://bdu.fstec.ru/vul/2024-07031 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-bshacepe-bApeHSx7 · Vendor Advisory
• https://t.me/cvedetector/4330 · Telegram Post
• https://t.me/cvenotify/92526 · Telegram Post
• https://twitter.com/CVESource/status/1828849459284922790 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1828870776566489322 · Twitter Post
• https://twitter.com/CVEnew/status/1828836207729549442 · Twitter Post