Log in Start free

Vulnerability · Published Nov 6, 2024 · Assigned by cisco

CVE-2024-20371Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability

Medium 5.3

In plain English

A medium-severity security flaw in Cisco Nexus 3550 System Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device.  This vulnerability exists because ACL deny rules are not properly enforced at the time of device reboot. An attacker could exploit this vulnerability by attempting to send traffic to the management interface of an affected device. A successful exploit could allow the attacker to send traffic to the management interface of the affected device.

Affected products (as reported)

VendorProductVersions
Cisco Cisco Nexus 3550 System Software 3550-F_1.11.33550-F_1.12.03550-F_1.16.03550-F_1.17.13550-F_1.11.13550-F_1.11.23550-F_1.15.03550-F_1.13.0

Weakness: CWE-264 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References