Cisco NX-OS Command Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM

6 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Exploitation Likelihood

EPSS Prediction

0.78 %

Predictive Probability

Percentile Rank

73.7 th

Documented as more likely to be exploited than 73.7% of known CVEs.

Detection Date

Jul 02, 2024

Remediation Due

Jul 23, 2024

CISA Catalog Active

Threat Analysis

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-20399