Cisco NX-OS Software Vulnerability Allows Low-Privileged Attackers to Escape Python Sandbox and Access Underlying OS
CVE-2024-20286

8.8HIGH

Key Information:

Vendor

Cisco
Status
Nx-os
Vendor
CVE Published:
28 August 2024

What is CVE-2024-20286?

A vulnerability in the Python interpreter of Cisco NX-OS Software poses risks to the security of devices running this software. It arises from inadequate validation of user-supplied input, allowing low-privileged, authenticated local attackers to potentially escape the Python sandbox. By manipulating specific functions within the interpreter, an attacker could execute arbitrary commands on the device's underlying operating system with the same privileges as the authenticated user. It is essential for users with Python execution privileges to review product-specific documentation for further details and security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://sec.cloudapps.cisco.com/security/center/content/C...
https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.