Vulnerability · Published Aug 28, 2024 · Assigned by cisco
CVE-2024-20285Cisco NX-OS Software Python Parser Escape Vulnerability
Medium 5.3
In plain English
A medium-severity security flaw in Cisco NX-OS Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. Note: An attacker must be authenticated with Python execution privileges to exploit these vulnerabilities. For more information regarding Python execution privileges, see product-specific documentation, such as the section of the Cisco Nexus 9000 Series NX-OS Programmability Guide.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco NX-OS Software | 7.3(6)N1(1a)8.4(2)7.3(6)N1(1)9.2(3)7.0(3)I5(2)8.2(1)6.0(2)A8(7a)7.0(3)I4(5) |
Weakness: CWE-653 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L