InfoSecBulletin Cybersecurity for mankind
A bootloader vulnerability in Cisco NX-OS affects over 100 switches, enabling attackers to bypass image signature checks.
Cisco issued security patches for the vulnerability CVE-2024-20397 (CVSS score of 5.2) in NX-OS software’s bootloader, which could allow attackers to bypass image signature verification.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
Oracle Critical Pre-Release update addressed 320 flaw
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS
Intel holds 22 employees from one Bangladeshi University
VPN Surge 1500% in USA after TikTok Shut Down
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology
“A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.” reads the advisory.
The vulnerability stems from insecure bootloader settings, allowing an attacker to run specific bootloader commands to exploit it.
“A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.” continues the advisory.
This vulnerability affects certain Cisco products running vulnerable BIOS versions, regardless of their configuration:
UCS 6400 Series Fabric Interconnects (CSCwj35846)
UCS 6500 Series Fabric Interconnects (CSCwj35846)
Nexus 9000 Series Fabric Switches in ACI mode (CSCwn11901)
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwm47438)
MDS 9000 Series Multilayer Switches (CSCwh76163)
Nexus 3000 Series Switches (CSCwm47438)
Nexus 7000 Series Switches (CSCwh76166)
Cisco has stated that there are no solutions to fix this vulnerability.
PSIRT is not aware of any real-world attacks using this vulnerability CVE-2024-20397
Cisco will not fix the vulnerability for Nexus 92160YC-X since it is no longer supported.
