InfoSecBulletin Cybersecurity for mankind
There is a security flaw (CVE-2024-20399) in Cisco NX-OS Software that lets an attacker with local access execute commands as root on the affected device.
The vulnerability is caused by not properly checking the arguments used in certain configuration CLI commands. An attacker can take advantage of this vulnerability by inserting a specially-made input as an argument in one of the affected configuration CLI commands. If successful, the attacker could run any commands they want on the operating system with root privileges.
To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. Cisco released updates to fix this issue. There are no other solutions available for this problem.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP
Affected Products:
Vulnerable Products
The following Cisco products were affected at the time of publication:
MDS 9000 Series Multilayer Switches (CSCwj97007)
Nexus 3000 Series Switches (CSCwj97009)1
Nexus 5500 Platform Switches (CSCwj97011)
Nexus 5600 Platform Switches (CSCwj97011)
Nexus 6000 Series Switches (CSCwj97011)
Nexus 7000 Series Switches (CSCwj94682)2
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwj97009)1
1. Cisco NX-OS Software releases running on Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode do not provide extra privileges because of the bash-shell feature. The issue does not affect Cisco NX-OS Software releases 9.3(5) and later, except for specific Cisco platforms.
Nexus 3000 platforms:
N3K-C3264C-E
N3K-C3172PQ-10GE
N3K-C3172PQ-10GE-XL
N3K-C3172TQ-10GT
N3K-C3548P-10GX
Nexus 9000 platforms:
N9K-C92348GC-X (fixed in Cisco NX-OS Software releases 10.4.3 and later)
2. Cisco NX-OS Software releases 8.1(0) and later on Cisco Nexus 7000 Series Switches do not provide extra privileges because of the bash-shell feature.
For more information on this vulnerability, see the Details section of this advisory.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
