InfoSecBulletin Cybersecurity for mankind
There is a security flaw (CVE-2024-20399) in Cisco NX-OS Software that lets an attacker with local access execute commands as root on the affected device.
The vulnerability is caused by not properly checking the arguments used in certain configuration CLI commands. An attacker can take advantage of this vulnerability by inserting a specially-made input as an argument in one of the affected configuration CLI commands. If successful, the attacker could run any commands they want on the operating system with root privileges.
To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. Cisco released updates to fix this issue. There are no other solutions available for this problem.
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP
Affected Products:
Vulnerable Products
The following Cisco products were affected at the time of publication:
MDS 9000 Series Multilayer Switches (CSCwj97007)
Nexus 3000 Series Switches (CSCwj97009)1
Nexus 5500 Platform Switches (CSCwj97011)
Nexus 5600 Platform Switches (CSCwj97011)
Nexus 6000 Series Switches (CSCwj97011)
Nexus 7000 Series Switches (CSCwj94682)2
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwj97009)1
1. Cisco NX-OS Software releases running on Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode do not provide extra privileges because of the bash-shell feature. The issue does not affect Cisco NX-OS Software releases 9.3(5) and later, except for specific Cisco platforms.
Nexus 3000 platforms:
N3K-C3264C-E
N3K-C3172PQ-10GE
N3K-C3172PQ-10GE-XL
N3K-C3172TQ-10GT
N3K-C3548P-10GX
Nexus 9000 platforms:
N9K-C92348GC-X (fixed in Cisco NX-OS Software releases 10.4.3 and later)
2. Cisco NX-OS Software releases 8.1(0) and later on Cisco Nexus 7000 Series Switches do not provide extra privileges because of the bash-shell feature.
For more information on this vulnerability, see the Details section of this advisory.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
