Riskcovery

CVE-2024-20289

Cisco NX-OS Software Command Injection Vulnerability

State
Published
Severity
4.4 Medium
Published
Aug 28, 2024
Updated
Aug 28, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device. 

This vulnerability is due to insufficient validation of arguments for a specific CLI command. An attacker could exploit this vulnerability by including crafted input as the argument of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.

Scores

CVSSScoreVectorSource
3.14.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
Cisco NX-OS SoftwareCisco
  • 9.3(3)Affected
  • 9.3(4)Affected
  • 9.3(5)Affected
  • 9.3(6)Affected
  • 10.1(2)Affected
  • 10.1(1)Affected
  • 9.3(5w)Affected
  • 9.3(7)Affected
  • 9.3(7k)Affected
  • 10.2(1)Affected
  • 9.3(7a)Affected
  • 9.3(8)Affected
  • 10.2(1q)Affected
  • 10.2(2)Affected
  • 9.3(9)Affected
  • 10.1(2t)Affected
  • 10.2(3)Affected
  • 10.2(3t)Affected
  • 9.3(10)Affected
  • 10.2(2a)Affected
  • 10.3(1)Affected
  • 10.2(4)Affected
  • 10.3(2)Affected
  • 9.3(11)Affected
  • 10.3(3)Affected
  • and 17 more versions
Cisco NX-OS System Software in ACI ModeCisco
  • 16.0(2h)Affected
  • 16.0(2j)Affected
  • 16.0(3d)Affected
  • 16.0(3e)Affected
  • 16.0(4c)Affected
  • 16.0(5h)Affected
  • 16.0(3g)Affected
  • 16.0(5j)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.