CVE-2024-20399
Cisco NX-OS Command Injection Vulnerability
Description
CVE-2024-20399 is a medium-severity command injection vulnerability in the CLI of Cisco NX-OS Software that allows an authenticated administrator to execute arbitrary commands as root on the underlying operating system. The vulnerability affects a broad range of Cisco switching platforms including Nexus 3000, 5000, 6000, 7000, and 9000 series, as well as MDS 9000 and UCS Fabric Interconnect. With a CVSS v3.1 score of 6.0, this vulnerability was actively exploited by the China-nexus threat group Velvet Ant and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 23, 2024. The EPSS score of 0.61% at the 69.5th percentile reflects moderate exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | nx-os | 6.2\(2\); 6.2\(2a\); 6.2\(6\); 6.2\(6a\); 6.2\(6b\); 6.2\(8\); 6.2\(8a\); 6.2\(8b\); 6.2\(10\); 6.2\(12\); 6.2\(14\); 6.2\(16\); 6.2\(18\); 6.2\(20\); 6.2\(20a\); 6.2\(22\); 6.2\(24\); 6.2\(24a\); 7.2\(0\)d1\(1\); 7.2\(1\)d1\(1\); 7.2\(2\)d1\(1\); 7.2\(2\)d1\(2\); 7.3\(0\)d1\(1\); 7.3\(0\)dx\(1\); 7.3\(1\)d1\(1\); 7.3\(2\)d1\(1\); 7.3\(2\)d1\(2\); 7.3\(2\)d1\(3\); 7.3\(2\)d1\(3a\); 7.3\(3\)d1\(1\); 7.3\(4\)d1\(1\); 7.3\(5\)d1\(1\); 7.3\(6\)d1\(1\); 7.3\(7\)d1\(1\); 7.3\(8\)d1\(1\); 7.3\(9\)d1\(1\); 8.0\(1\); 8.1\(1\); 8.1\(2\); 8.1\(2a\); 8.2\(1\); 8.2\(2\); 8.2\(3\); 8.2\(4\); 8.2\(5\); 8.2\(6\); 8.2\(7\); 8.2\(7a\); 8.2\(8\); 8.2\(9\); 8.2\(10\); 8.2\(11\); 8.3\(1\); 8.3\(2\); 8.4\(1\); 8.4\(2\); 8.4\(3\); 8.4\(4\); 8.4\(4a\); 8.4\(5\); 8.4\(6\); 8.4\(6a\); 8.4\(7\); 8.4\(8\); 8.4\(9\); 6.2\(1\); 6.2\(3\); 6.2\(5\); 6.2\(5a\); 6.2\(5b\); 6.2\(7\); 6.2\(9\); 6.2\(9a\); 6.2\(9b\); 6.2\(9c\); 6.2\(11\); 6.2\(11b\); 6.2\(11c\); 6.2\(11d\); 6.2\(11e\); 6.2\(13\); 6.2\(13a\); 6.2\(13b\); 6.2\(15\); 6.2\(17\); 6.2\(19\); 6.2\(21\); 6.2\(23\); 6.2\(25\); 6.2\(27\); 6.2\(29\); 6.2\(31\); 6.2\(33\); 7.3\(0\)dy\(1\); 7.3\(1\)dy\(1\); 8.1\(1a\); 8.1\(1b\); 8.4\(1a\); 8.4\(2a\); 8.4\(2b\); 8.4\(2c\); 8.4\(2d\); 8.4\(2e\); 8.4\(2f\); 8.5\(1\); 9.2\(1\); 9.2\(1a\); 9.2\(2\); 9.3\(1\); 9.3\(2\); 9.3\(2a\); 9.4\(1\); 9.4\(1a\); 9.4\(2\); 6.0\(2\)a6\(1\); 6.0\(2\)a6\(1a\); 6.0\(2\)a6\(2\); 6.0\(2\)a6\(2a\); 6.0\(2\)a6\(3\); 6.0\(2\)a6\(3a\); 6.0\(2\)a6\(4\); 6.0\(2\)a6\(4a\); 6.0\(2\)a6\(5\); 6.0\(2\)a6\(5a\); 6.0\(2\)a6\(5b\); 6.0\(2\)a6\(6\); 6.0\(2\)a6\(7\); 6.0\(2\)a6\(8\); 6.0\(2\)a8\(1\); 6.0\(2\)a8\(2\); 6.0\(2\)a8\(3\); 6.0\(2\)a8\(4\); 6.0\(2\)a8\(4a\); 6.0\(2\)a8\(5\); 6.0\(2\)a8\(6\); 6.0\(2\)a8\(7\); 6.0\(2\)a8\(7a\); 6.0\(2\)a8\(7b\); 6.0\(2\)a8\(8\); 6.0\(2\)a8\(9\); 6.0\(2\)a8\(10\); 6.0\(2\)a8\(10a\); 6.0\(2\)a8\(11\); 6.0\(2\)a8\(11a\); 6.0\(2\)a8\(11b\); 6.0\(2\)u6\(1\); 6.0\(2\)u6\(1a\); 6.0\(2\)u6\(2\); 6.0\(2\)u6\(2a\); 6.0\(2\)u6\(3\); 6.0\(2\)u6\(3a\); 6.0\(2\)u6\(4\); 6.0\(2\)u6\(4a\); 6.0\(2\)u6\(5\); 6.0\(2\)u6\(5a\); 6.0\(2\)u6\(5b\); 6.0\(2\)u6\(5c\); 6.0\(2\)u6\(6\); 6.0\(2\)u6\(7\); 6.0\(2\)u6\(8\); 6.0\(2\)u6\(9\); 6.0\(2\)u6\(10\); 7.0\(3\)f1\(1\); 7.0\(3\)f2\(1\); 7.0\(3\)f2\(2\); 7.0\(3\)f3\(1\); 7.0\(3\)f3\(2\); 7.0\(3\)f3\(3\); 7.0\(3\)f3\(3a\); 7.0\(3\)f3\(3c\); 7.0\(3\)f3\(4\); 7.0\(3\)f3\(5\); 7.0\(3\)i4\(1\); 7.0\(3\)i4\(2\); 7.0\(3\)i4\(3\); 7.0\(3\)i4\(4\); 7.0\(3\)i4\(5\); 7.0\(3\)i4\(6\); 7.0\(3\)i4\(7\); 7.0\(3\)i4\(8\); 7.0\(3\)i4\(8a\); 7.0\(3\)i4\(8b\); 7.0\(3\)i4\(8z\); 7.0\(3\)i4\(9\); 7.0\(3\)i5\(1\); 7.0\(3\)i5\(2\); 7.0\(3\)i6\(1\); 7.0\(3\)i6\(2\); 7.0\(3\)i7\(1\); 7.0\(3\)i7\(2\); 7.0\(3\)i7\(3\); 7.0\(3\)i7\(4\); 7.0\(3\)i7\(5\); 7.0\(3\)i7\(5a\); 7.0\(3\)i7\(6\); 7.0\(3\)i7\(7\); 7.0\(3\)i7\(8\); 7.0\(3\)i7\(9\); 7.0\(3\)i7\(10\); 9.2\(2t\); 9.2\(2v\); 9.2\(3\); 9.2\(4\); 9.3\(3\); 9.3\(4\); 9.3\(5\); 9.3\(6\); 9.3\(7\); 9.3\(7a\); 9.3\(8\); 9.3\(9\); 9.3\(10\); 9.3\(11\); 9.3\(12\); 9.3\(13\); 10.1\(1\); 10.1\(2\); 10.2\(1\); 10.2\(1q\); 10.2\(2\); 10.2\(3\); 10.2\(4\); 10.2\(5\); 10.2\(6\); 10.2\(7\); 10.2\(8\); 10.3\(1\); 10.3\(2\); 10.3\(3\); 10.3\(4a\); 10.3\(5\); 10.3\(99w\); 10.3\(99x\); 10.4\(1\); 10.4\(2\); 7.1\(0\)n1\(1\); 7.1\(0\)n1\(1a\); 7.1\(0\)n1\(1b\); 7.1\(1\)n1\(1\); 7.1\(2\)n1\(1\); 7.1\(3\)n1\(1\); 7.1\(3\)n1\(2\); 7.1\(4\)n1\(1\); 7.1\(5\)n1\(1\); 7.1\(5\)n1\(1b\); 7.3\(0\)n1\(1\); 7.3\(1\)n1\(1\); 7.3\(2\)n1\(1\); 7.3\(3\)n1\(1\); 7.3\(4\)n1\(1\); 7.3\(5\)n1\(1\); 7.3\(6\)n1\(1\); 7.3\(7\)n1\(1\); 7.3\(7\)n1\(1a\); 7.3\(7\)n1\(1b\); 7.3\(8\)n1\(1\); 7.3\(9\)n1\(1\); 7.3\(10\)n1\(1\); 7.3\(11\)n1\(1\); 7.3\(12\)n1\(1\); 7.3\(13\)n1\(1\); 7.3\(14\)n1\(1\) |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP(Vendor Advisory)
- https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20399(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-20399, but the vulnerability is a classic command injection flaw. The issue stems from insufficient validation of arguments passed to specific configuration CLI commands in NX-OS. When an authenticated administrator provides specially crafted input to certain CLI commands, the input is passed unsanitized to the underlying Linux operating system, allowing arbitrary command execution as root. This type of vulnerability typically aligns with CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where user-controlled input is incorporated into operating system commands without proper sanitization.
Impact Analysis
CVE-2024-20399 enables an attacker with valid administrator credentials to break out of the NX-OS CLI sandbox and execute arbitrary commands directly on the underlying Linux operating system as root. The CVSS vector reflects a Local attack (AV:L) with Low complexity (AC:L) but requires High privileges (PR:H), specifically administrator-level access to the NX-OS CLI. Confidentiality (High): the attacker can access all data on the switch, including routing tables, VLAN configurations, authentication credentials, and any traffic being processed by the device. Integrity (High): with root access to the underlying OS, the attacker can modify firmware, install persistent backdoors, alter network configurations, and manipulate traffic flows without leaving traces in NX-OS audit logs. Availability is not directly impacted (A:N) according to the CVSS rating, though root access could certainly be used to disrupt operations. The real-world impact was demonstrated by the Velvet Ant threat group, which exploited this vulnerability to maintain persistent access to network infrastructure. The EPSS score of 0.61% at the 69.5th percentile indicates moderate but real exploitation probability, and the ransomware association is listed as unknown.
Exploit Maturity
CVE-2024-20399 has confirmed active exploitation by a sophisticated nation-state threat actor. The China-nexus group known as Velvet Ant was identified by Sygnia as exploiting this zero-day vulnerability to install custom malware on Cisco Nexus switches, maintaining persistent and stealthy access to network infrastructure. CISA added CVE-2024-20399 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 23, 2024. Cisco published a detailed security advisory addressing the vulnerability. While the EPSS score of 0.61% at the 69.5th percentile appears moderate, the confirmed use by an APT group and the strategic value of network infrastructure devices make this vulnerability a high-priority concern regardless of broad exploitation statistics.
Remediation
-
Apply the Cisco NX-OS security update as documented in the Cisco Security Advisory cisco-sa-nxos-cmd-injection-xD9OhyOP. Identify the specific fixed release for your NX-OS version and platform, and schedule the upgrade during a maintenance window.
-
Audit administrator account access on all Cisco NX-OS devices. Since exploitation requires valid administrator credentials, restrict admin access to the minimum number of accounts necessary, enforce strong authentication policies, and implement role-based access control (RBAC) to limit the CLI commands available to each administrator.
-
Monitor NX-OS devices for indicators of compromise associated with the Velvet Ant campaign. Review system logs for unexpected processes, unusual file modifications on the underlying Linux OS, and unauthorized configuration changes. Sygnia's threat report provides specific indicators to look for.
-
Implement network segmentation for management interfaces to ensure that NX-OS CLI access is only available through dedicated out-of-band management networks. Never expose switch management interfaces directly to the internet or untrusted network segments.
-
Enable comprehensive logging and forwarding from NX-OS devices to a centralized SIEM solution. Since root-level access can bypass NX-OS audit logs, correlate network device logs with network traffic analysis to detect anomalous behavior.
Technical Details
CVE-2024-20399 is a command injection vulnerability in Cisco NX-OS with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, yielding a score of 6.0 (Medium). The Attack Vector is Local (AV:L), meaning the attacker must have CLI access to the NX-OS device, typically through SSH or console connection. Attack Complexity is Low (AC:L), indicating that once authenticated, exploitation is straightforward. Privileges Required is High (PR:H), necessitating administrator-level credentials. User Interaction is None (UI:N), and the Scope is Unchanged (S:U). The vulnerability exists because specific configuration CLI commands in NX-OS do not properly validate their arguments before passing them to the underlying Linux operating system. An attacker with administrator access can craft input that includes embedded OS commands, which are then executed as root on the Linux kernel underlying NX-OS. This is particularly dangerous because NX-OS is designed as a restricted CLI environment, and root access to the underlying OS bypasses all intended security boundaries. The affected platform list is extensive, spanning NX-OS versions from 6.0 through 10.4 across Nexus 3000, 5000, 6000, 7000, and 9000 series switches, MDS 9000 series, and UCS 6300 Fabric Interconnects.
Frequently Asked Questions
Is CVE-2024-20399 being actively exploited?
Yes. The China-nexus threat group Velvet Ant was identified exploiting CVE-2024-20399 as a zero-day to install custom malware on Cisco Nexus switches. CISA has added this vulnerability to the KEV catalog with a mandatory remediation deadline.
What devices are affected by CVE-2024-20399?
A wide range of Cisco devices running NX-OS are affected, including the Nexus 3000, 5000, 6000, 7000, and 9000 series switches, MDS 9000 series storage switches, and UCS 6300 Fabric Interconnects. NX-OS versions from 6.0 through 10.4 are vulnerable.
Does an attacker need special access to exploit CVE-2024-20399?
Yes. The attacker must possess valid administrator credentials for the NX-OS CLI. However, once authenticated as an administrator, exploitation is straightforward with low complexity. This makes credential theft and unauthorized admin account creation important attack precursors to monitor.
Is CVE-2024-20399 linked to ransomware?
The ransomware association is currently listed as unknown. However, the vulnerability was exploited by a nation-state APT group for persistent network access, which represents an equally serious threat to organizations relying on Cisco switching infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.