CVE-2024-20449

Summary

A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device.

This vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques. A successful exploit could allow the attacker to execute arbitrary code in a specific container with the privileges of root.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Data Center Network Manager12.1(1)affected
CiscoCisco Data Center Network Manager12.0.1aaffected
CiscoCisco Data Center Network Manager12.0.2daffected
CiscoCisco Data Center Network Manager12.0.2faffected
CiscoCisco Data Center Network Manager12.1.1affected
CiscoCisco Data Center Network Manager12.1.1eaffected
CiscoCisco Data Center Network Manager12.1.1paffected
CiscoCisco Data Center Network Manager12.1.2eaffected
CiscoCisco Data Center Network Manager12.1.2paffected
CiscoCisco Data Center Network Manager12.1.3baffected
CiscoCisco Data Center Network Manager12.2.1affected

Weaknesses

  • CWE-23: Relative Path Traversal

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References