Content
Priority: ● Medium
Status: In Progress- Undergoing Analysis
First Published: 3 July, 2024
Advisory Version: 1.0
References: CVE-2024-20399
Summary
A recently announced vulnerability in certain versions of the command line interface (CLI) of Cisco's NX-OS software could allow an attacker to run arbitrary commands as the root user. This vulnerability stems from insufficient validation of command line arguments passed to certain NX-OS CLI commands. Cisco has classified this vulnerability as "Medium"; an attacker must already have Administrator credentials in order to exploit this vulnerability.
Affected Products
- MDS 9000 Series Multilayer Switches
- Nexus 3000 Series Switches
- Nexus 5500 Platform Switches
- Nexus 5600 Platform Switches
- Nexus 6000 Series Switches
- Nexus 7000 Series Switches
- Nexus 9000 Series Switches in standalone NX-OS mode
Recommended Actions
We highly recommend customers review Cisco's Security Advisory to assess their exposure based on their device configurations and then implement the recommended fixed versions as needed. Fixed, Hitachi Vantara-qualified NX-OS versions are available for support-entitled customers.
If any of the information presented above remains unclear, please contact the Hitachi Vantara Global Support Center, or your Vantara-authorized service and support provider.
The information contained herein is for informational purposes only. It is not intended as a guaranty or warranty about Hitachi Vantara’s products, including any guaranty or warranty that any product cannot be exploited by third parties. All product warranties and obligations to a customer must be specified in a mutually acceptable and executed contract between the parties.