Elevated Privilege Vulnerability in Cisco Nexus Dashboard

CVE-2024-20282

What is CVE-2024-20282?

A vulnerability in Cisco Nexus Dashboard allows authenticated local attackers with valid rescue-user credentials to elevate their privileges to root on affected devices. This issue arises from inadequate protection of a sensitive access token. By exploiting this vulnerability, attackers can utilize the access token to gain unauthorized access to essential resources within the device's infrastructure. If successfully exploited, this vulnerability can enable attackers to secure root access to the filesystem or hosted containers, posing a significant security risk.

References