Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-20399Cisco NX-OS Software CLI Command Injection Vulnerability

Description

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root. Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges: Nexus 3000 Series Switches Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later Nexus 9000 Series Switches in standalone NX-OS mode

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco NX-OS Command Injection Vulnerability.

Added
2 Jul 2024
Fix due (US federal)
23 Jul 2024
Used by ransomware
Not known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 2 Jul 2024.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.

Timeline

  1. ID reserved

    By cisco

  2. · 8 months later

    Published

  3. · 1 day later

    Added to CISA KEV

    Known exploited in the wild

  4. · 16 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-20399, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Analyzed3.1Medium6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
4.3% · top 8.7% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Affected products

  • Cisco · Cisco NX-OS Software

    • affected 8.2(5)
    • affected 7.3(6)N1(1a)
    • affected 7.3(5)D1(1)
    • affected 8.4(2)
    • affected 7.3(6)N1(1)
    • affected 6.2(2)
    • affected 8.4(3)
    • affected 9.2(3)
    • affected 7.0(3)I5(2)
    • affected 8.2(1)
    • affected 6.0(2)A8(7a)
    • affected 7.0(3)I4(5)
    • affected 6.0(2)A6(1)
    • affected 7.3(1)D1(1)
    • affected 6.2(14a)
    • affected 7.0(3)I4(6)
    • affected 7.3(4)N1(1)
    • affected 7.0(3)I4(3)
    • affected 9.2(2v)
    • affected 6.0(2)A6(5b)
    • affected 7.3(0)D1(1)
    • affected 6.2(17a)
    • affected 7.0(3)I4(7)
    • affected 6.0(2)U6(1a)
    • affected 7.1(5)N1(1b)
    • affected 7.0(3)I4(1)
    • affected 7.0(3)I4(8)
    • affected 7.0(3)I4(2)
    • affected 7.1(4)N1(1c)
    • affected 7.0(3)IM3(1)
    • affected 6.0(2)U6(5a)
    • affected 6.0(2)A8(11)
    • affected 6.0(2)A6(4a)
    • affected 6.2(9)
    • affected 6.2(5)
    • affected 7.3(4)D1(1)
    • affected 6.2(20)
    • affected 9.2(1)
    • affected 9.2(2t)
    • affected 9.2(3y)
    • and 278 more

What to do

Exploitation: In May 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild.

References

References3

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-20399 badge
[![CVE-2024-20399](https://cveledger.app/badge/CVE-2024-20399.svg)](https://cveledger.app/cve/CVE-2024-20399)

Record last updated .