PT-2024-6149 · Cisco · Cisco Nx-Os+1

Chris Dean

·

Published

2024-08-28

·

Updated

2024-10-22

·

CVE-2024-20285

CVSS v3.1

8.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)
Description The issue is related to insufficient validation of user-supplied input in the Python interpreter of Cisco NX-OS Software, allowing an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. An attacker could exploit this by manipulating specific functions within the Python interpreter, potentially executing arbitrary commands on the underlying operating system with the privileges of the authenticated user. Note that an attacker must be authenticated with Python execution privileges to exploit this issue.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-653

Related Identifiers

BDU:2024-07068
CVE-2024-20285

Affected Products

Cisco Nx-Os
Cisco Nexus