CVE-2024-20291 Missing authorization in Cisco NX-OS Software
Unauthenticated remote attackers can bypass ACLs on port channel subinterfaces to access protected network resources due to incorrect hardware programming.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-20291?
CVE-2024-20291 is a medium-severity missing authorization vulnerability in Cisco Nx-Os, published on 28 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
Which versions are affected by CVE-2024-20291?
It affects 1 product.
Products include Cisco Nx-Os.
How do I fix CVE-2024-20291?
No fix has been published for CVE-2024-20291 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-20291 being exploited?
There is no known exploitation of CVE-2024-20291 in the wild and no public exploit code.
Other vulnerabilities in Cisco Nx-Os
Sources
Also known as GHSA-wwgf-8wgf-pm54.