PT-2024-8633 · Cisco · Cisco Nexus Dashboard Fabric Controller

Published 2024-10-02 · Updated 2024-10-08 · CVE-2024-20449

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard Fabric Controller (NDFC) (affected versions not specified)

Description The issue is related to improper path validation in the Cisco Nexus Dashboard Fabric Controller (NDFC), which could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This can be achieved by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques, potentially allowing the attacker to execute arbitrary code in a specific container with the privileges of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

BDU:2024-10223

CVE-2024-20449

Affected Products

Cisco Nexus Dashboard Fabric Controller

References · 10

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20449 · Security Note
• https://bdu.fstec.ru/vul/2024-10223 · Security Note
• https://twitter.com/cracbot/status/1843169452189421601 · Twitter Post
• https://recordedfuture.com/vulnerability-database/CVE-2024-20449 · Note
• https://twitter.com/VulmonFeeds/status/1841567822968660197 · Twitter Post
• https://github.com/advisories/GHSA-xmpq-x22f-7jg3 · Note
• https://twitter.com/CveFindCom/status/1841523956848742819 · Twitter Post
• https://twitter.com/CVEnew/status/1841527246462582984 · Twitter Post