InfoSecBulletin Cybersecurity for mankind
A bootloader vulnerability in Cisco NX-OS affects over 100 switches, enabling attackers to bypass image signature checks.
Cisco issued security patches for the vulnerability CVE-2024-20397 (CVSS score of 5.2) in NX-OS software’s bootloader, which could allow attackers to bypass image signature verification.
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Over 25K SonicWall VPN Firewalls exposed to critical flaws
AI-made nude images incident, one school, 50 female victim
Over 4 lac files ‘leaked’: Telecom Namibia hit by major cyberattack
HSBC sued by ASIC: customers allegedly scammed of $23 million
Sophos Thwarts Global Firewall Attack promptly, Protects Thousands from Data Theft
Android malware attack Indian banks: Infected 419 devices
Indian-American OpenAI whistleblower Suchir Balaji found dead in San Francisco
Canadian company exposed unprotected almost 5 million records
“A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.” reads the advisory.
The vulnerability stems from insecure bootloader settings, allowing an attacker to run specific bootloader commands to exploit it.
“A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.” continues the advisory.
This vulnerability affects certain Cisco products running vulnerable BIOS versions, regardless of their configuration:
UCS 6400 Series Fabric Interconnects (CSCwj35846)
UCS 6500 Series Fabric Interconnects (CSCwj35846)
Nexus 9000 Series Fabric Switches in ACI mode (CSCwn11901)
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwm47438)
MDS 9000 Series Multilayer Switches (CSCwh76163)
Nexus 3000 Series Switches (CSCwm47438)
Nexus 7000 Series Switches (CSCwh76166)
Cisco has stated that there are no solutions to fix this vulnerability.
PSIRT is not aware of any real-world attacks using this vulnerability CVE-2024-20397
Cisco will not fix the vulnerability for Nexus 92160YC-X since it is no longer supported.
