A critical zero-day vulnerability, known as CVE-2024-20399, exists in the Command Line Interface (CLI) of Cisco NX-OS Software. This flaw allows attackers to run arbitrary commands as root on affected devices, posing a severe risk to network security, especially for those using Cisco's Nexus and MDS series switches. The issue stems from inadequate validation of arguments given to specific CLI commands. An attacker with admin rights can exploit this by inputting specially crafted arguments during a CLI command, gaining root access and the ability to execute any commands.
The Cisco Product Security Incident Response Team (PSIRT) discovered this vulnerability being actively exploited in April 2024, linking the attacks to a Chinese state-sponsored group called Velvet Ant. This group deployed malware through the flaw, enabling remote control, file uploads, and hidden malicious activities. Cisco has issued software updates to fix this issue, but there are no temporary solutions. It's crucial for administrators to install these updates immediately and frequently update admin passwords to reduce risks. Cisco offers a Software Checker tool to help identify affected software and the necessary updates. Organizations using affected Cisco products should prioritize patching and closely watch their networks for suspicious activity.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP
https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
#cybersecurity #cisco #vulnerability #zeroday #cve #cli #nxos #nexus #mds #switch #root #psirt #velvetant #software #patch #update