InfoSecBulletin Cybersecurity for mankind
A bootloader vulnerability in Cisco NX-OS affects over 100 switches, enabling attackers to bypass image signature checks.
Cisco issued security patches for the vulnerability CVE-2024-20397 (CVSS score of 5.2) in NX-OS software’s bootloader, which could allow attackers to bypass image signature verification.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
“A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.” reads the advisory.
The vulnerability stems from insecure bootloader settings, allowing an attacker to run specific bootloader commands to exploit it.
“A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.” continues the advisory.
This vulnerability affects certain Cisco products running vulnerable BIOS versions, regardless of their configuration:
UCS 6400 Series Fabric Interconnects (CSCwj35846)
UCS 6500 Series Fabric Interconnects (CSCwj35846)
Nexus 9000 Series Fabric Switches in ACI mode (CSCwn11901)
Nexus 9000 Series Switches in standalone NX-OS mode (CSCwm47438)
MDS 9000 Series Multilayer Switches (CSCwh76163)
Nexus 3000 Series Switches (CSCwm47438)
Nexus 7000 Series Switches (CSCwh76166)
Cisco has stated that there are no solutions to fix this vulnerability.
PSIRT is not aware of any real-world attacks using this vulnerability CVE-2024-20397
Cisco will not fix the vulnerability for Nexus 92160YC-X since it is no longer supported.
