Vulnerability in Python Interpreter Could Lead to Unauthorized Access

CVE-2024-20285

Summary

A vulnerability exists in the Python interpreter of Cisco NX-OS Software that enables a local attacker with authenticated Python execution privileges to escape the Python sandbox environment. This vulnerability arises from insufficient validation of user-supplied input within the Python interpreter. An attacker could exploit this by manipulating specific functions, leading to the execution of arbitrary commands on the underlying operating system with the privileges of the authenticated user. Reference documentation detailing Python execution privileges can provide further information on this issue.

References