Cisco Patches Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20399 | Authenticated Command Injection in Cisco NX-OS Grants Root Privileges CVE-2024-20399 is a command injection flaw (CWE-78) in the CLI of Cisco NX-OS Software, caused by insufficient validation of arguments passed to specific configuration CLI commands. An authenticated attacker who already holds Administrator credentials can trigger it by submitting crafted input as the argument of an affected configuration command, gaining the ability to execute arbitrary commands as root on the device's underlying operating system. Because Administrator access is required, the flaw is effectively a privilege-escalation issue following credential compromise, and it grants no additional privilege on Nexus 3000 Series, Nexus 7000 Series running NX-OS 8.1(1) or later, and Nexus 9000 Series in standalone NX-OS mode, which already allow administrative bash-shell access to the OS. Any organization running affected NX-OS on Cisco Nexus switching is in scope, with the practical risk concentrated in environments where admin credentials may have been stolen. Exploitation has been observed in the wild: the China-linked group 'Velvet Ant' (associated with Salt Typhoon) used it as a zero-day to compromise U.S. ISPs and telecom providers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-02. Do: Upgrade affected Nexus switches to a fixed NX-OS release per Cisco's security advisory, as required by the CISA KEV listing (apply mitigations per vendor instructions or discontinue use if fixes are unavailable). Restrict and audit Administrator-level CLI access on NX-OS devices, and hunt for suspicious configuration-command activity or unexplained root-level actions, given Velvet Ant/Salt Typhoon targeting of telecom and ISP networks. For Nexus 3000, Nexus 7000 (8.1(1)+), and Nexus 9000 standalone-mode devices the flaw adds no privilege, but patching is still recommended. | 6.7 | 4% | KEV |
| masshundreds of thousands of NX-OS/Nexus devices deployed across enterprise and data-center networks (no authoritative public install count) |
Full article327 words · extracted from infosecurity-magazine.com · click to collapse
A newly patched zero-day vulnerability was exploited by Chinese state-backed hackers to compromise Cisco Nexus switches, researchers have revealed.
Cisco released a patch for CVE-2024-20399 on 2 July, 2024. The flaw is found in the CLI of Cisco NX-OS software and could allow an authenticated local attacker to execute arbitrary commands as root on a targeted device.
“This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands,” the advisory noted.
“An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.”
Read more on Cisco Nexus threats: Cisco Enterprise Switch Flaw Exposes Encrypted Traffic
However, because an attacker would need administrator privileges and access to specific configuration commands, the bug has only been given a CVSS score of 6.
That didn’t stop Chinese threat group Velvet Ant exploiting the vulnerability in an attack discovered in April, according to security vendor Sygnia.
“This exploitation led to the execution of a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices,” Sygnia explained.
“Despite the substantial pre-requisites for exploiting the discussed vulnerability, this incident demonstrates the tendency of sophisticated threat groups to leverage network appliances – which are often not sufficiently protected and monitored – to maintain persistent network access; the incident also underscores the critical importance of adhering to security best practices as a mitigation against this type of threat.”
Velvet Ant has previously been linked to a sophisticated multi-year cyber-espionage campaign in which the group used compromised F5 BIG-IP load balancers for persistence.
Sygnia urged Cisco customers to improve their centralized logging and network monitoring related to switches, and to harden systems with regular patching, good password hygiene and restricted admin access, among other steps.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisco-patches-zeroday-bug-chinese/