Vulnerability · Published Oct 2, 2024 · Assigned by cisco
CVE-2024-20444Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability
Medium 5.5
In plain English
A medium-severity argument injection in Cisco Data Center Network Manager from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Data Center Network Manager | 11.2(1)7.0(2)10.3(2)IPFM10.1(1)7.2(3)7.2(2)7.2(1)11.0(1) |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L