PT-2024-8206 · Cisco · Cisco Nexus 3550-F Switches

Published 2024-11-06 · Updated 2024-11-07 · CVE-2024-20371

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Nexus 3550-F Switches (affected versions not specified)

Description: A vulnerability in the access control list (ACL) programming could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device. This issue exists because ACL deny rules are not properly enforced at the time of device reboot. An attacker could exploit this by attempting to send traffic to the management interface of an affected device, potentially allowing the attacker to send traffic to the management interface of the affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2024-09748

CVE-2024-20371

Affected Products

Cisco Nexus 3550-F Switches

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-20371 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-3550-acl-bypass-mhskZc2q · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09748 · Security Note
• https://twitter.com/CVEnew/status/1854203378936537340 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1854314372048249264 · Twitter Post
• https://github.com/advisories/GHSA-q7hr-x75r-2mp7 · Note