InfoSecBulletin Cybersecurity for mankind
A bootloader vulnerability in Cisco NX-OS affects over 100 switches, enabling attackers to bypass image signature checks.
Cisco issued security patches for the vulnerability CVE-2024-20397 (CVSS score of 5.2) in NX-OS software’s bootloader, which could allow attackers to bypass image signature verification.
AWS Patches Multiple Vulns in WorkSpaces, AppStream 2.0
Malware Trends Review 2024: Ever Recorded Cyber Threats
Botnet Exploits 13,000 MikroTik Devices Abusing Misconfigured DNS
CVE-2024-9042
Code Execution Vulnerability Found in Kubernetes Windows Nodes
Hacker leaked 15k config files and VPN passwords of FortiGate firewall device
Registration open for 1st Agile Cyber Drill 2025
30 Days to Go for FutureCrime Summit 2025
Microsoft January 2025 Patch, 159 Vuls, 10 Critical RCE’s
CVE-2023-37936
Fortinet released update for a critical cryptographic key vuln
Millions of Accounts Vulnerable due to Google’s OAuth Flaw
“A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.” reads the advisory.
The vulnerability stems from insecure bootloader settings, allowing an attacker to run specific bootloader commands to exploit it.
“A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.” continues the advisory.
This vulnerability affects certain Cisco products running vulnerable BIOS versions, regardless of their configuration:
UCS 6400 Series Fabric Interconnects (CSCwj35846)
UCS 6500 Series Fabric Interconnects (CSCwj35846)
Nexus 9000 Series Fabric Switches in ACI mode (CSCwn11901)
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwm47438)
MDS 9000 Series Multilayer Switches (CSCwh76163)
Nexus 3000 Series Switches (CSCwm47438)
Nexus 7000 Series Switches (CSCwh76166)
Cisco has stated that there are no solutions to fix this vulnerability.
PSIRT is not aware of any real-world attacks using this vulnerability CVE-2024-20397
Cisco will not fix the vulnerability for Nexus 92160YC-X since it is no longer supported.
