Home / Vulnerabilities / CVE-2024-20399
MEDIUM SEVERITY
CVE-2024-20399 Cisco · NX-OS

Cisco NX-OS Command Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM
6 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Exploitation Likelihood

EPSS Prediction

0.61 %
Predictive Probability
Percentile Rank
69.4 th

Documented as more likely to be exploited than 69.4% of known CVEs.

Detection Date

Jul 02, 2024

Remediation Due

Jul 23, 2024

CISA Catalog Active

Threat Analysis

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-20399