Riskcovery

CVE-2024-20444

Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability

State
Published
Severity
5.5 Medium
Published
Oct 2, 2024
Updated
Oct 2, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.   This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Lcisco

Weaknesses

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

ProductVersions
Cisco Data Center Network ManagerCisco
  • 11.2(1)Affected
  • 7.0(2)Affected
  • 10.3(2)IPFMAffected
  • 10.1(1)Affected
  • 7.2(3)Affected
  • 7.2(2)Affected
  • 7.2(1)Affected
  • 11.0(1)Affected
  • 10.4(1)Affected
  • 10.2(1)Affected
  • 7.2(2a)Affected
  • 10.1(2)Affected
  • 7.1(1)Affected
  • 12.1(1)Affected
  • 11.1(1)Affected
  • 10.3(1)Affected
  • 10.3(1)R(1)Affected
  • 7.0(1)Affected
  • 10.0(1)Affected
  • 7.1(2)Affected
  • 11.4(1)Affected
  • 10.4(2)Affected
  • 11.3(1)Affected
  • 11.5(1)Affected
  • 11.5(2)Affected
  • and 13 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.