Vulnerability · Published Dec 4, 2024 · Assigned by cisco
CVE-2024-20397Cisco NX-OS Software Image Verification Bypass Vulnerability
Medium 5.2
In plain English
A medium-severity improper access control in Cisco NX-OS Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco NX-OS Software | 8.2(5)7.3(5)D1(1)8.4(2)8.4(3)9.2(3)7.0(3)I5(2)8.2(1)6.0(2)A8(7a) |
| Cisco | Cisco NX-OS System Software in ACI Mode | 14.1(1j)14.0(3d)14.1(1k)13.2(1m)14.0(3c)13.2(2l)13.2(7k)14.1(1l) |
| Cisco | Cisco Unified Computing System (Managed) | 4.0(4c)4.0(2b)4.1(2a)4.0(1a)4.0(2a)4.0(1b)4.1(1c)4.0(4a) |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N