CVE-2024-20444 | THREATINT

Assigner	cisco
Reserved	2023-11-08
Published	2024-10-02
Updated	2024-10-02

Description

A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.   This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.

MEDIUM: 5.5

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Problem types

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Default status

unknown

11.2(1)

affected

7.0(2)

affected

10.3(2)IPFM

affected

10.1(1)

affected

7.2(3)

affected

7.2(2)

affected

7.2(1)

affected

11.0(1)

affected

10.4(1)

affected

10.2(1)

affected

7.2(2a)

affected

10.1(2)

affected

7.1(1)

affected

12.1(1)

affected

11.1(1)

affected

10.3(1)

affected

10.3(1)R(1)

affected

7.0(1)

affected

10.0(1)

affected

7.1(2)

affected

11.4(1)

affected

10.4(2)

affected

11.3(1)

affected

11.5(1)

affected

11.5(2)

affected

11.5(3)

affected

12.0.1a

affected

11.5(3a)

affected

12.0.2d

affected

12.0.2f

affected

11.5(4)

affected

12.1.1

affected

12.1.1e

affected

12.1.1p

affected

12.1.2e

affected

12.1.2p

affected

12.1.3b

affected

12.2.1

affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN (cisco-sa-ndfc-raci-T46k3jnN)

cve.org CVE-2024-20444

nvd.nist.gov CVE-2024-20444

Download JSON