Cisco NX-OS Software Image Verification Bypass Vulnerability (Cisco Cisco NX-OS Software)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Deferred
Description
A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | cisco |
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2024-18112
- GCVE · GCVE-0-2024-20397
CERT-FR advisories
- CERTFR-2024-AVI-1043 — Vulnérabilité dans Cisco NX-OS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco NX-OS Software | affected 8.2(5) ; affected 7.3(5)D1(1) ; affected 8.4(2) ; affected 8.4(3) ; affected 9.2(3) ; affected 7.0(3)I5(2) |
| Cisco · Cisco NX-OS System Software in ACI Mode | affected 14.1(1j) ; affected 14.0(3d) ; affected 14.1(1k) ; affected 13.2(1m) ; affected 14.0(3c) ; affected 13.2(2l) |
| Cisco · Cisco Unified Computing System (Managed) | affected 4.0(4c) ; affected 4.0(2b) ; affected 4.1(2a) ; affected 4.0(1a) ; affected 4.0(2a) ; affected 4.0(1b) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |