CVE-2024-20348: Command Injection
First published: Wed Apr 03 2024(Updated: )
A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this vulnerability through direct web requests to the provisioning server. A successful exploit could allow the attacker to read sensitive files in the PnP container that could facilitate further attacks on the PnP infrastructure.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Nexus Dashboard Fabric Controller |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2024-20348?
CVE-2024-20348 is considered a high severity vulnerability due to its potential for unauthenticated remote access to sensitive files.
How do I fix CVE-2024-20348?
To fix CVE-2024-20348, users should update their Cisco Nexus Dashboard Fabric Controller to the latest version as per the security advisories provided by Cisco.
Who is affected by CVE-2024-20348?
CVE-2024-20348 affects any installation of the Cisco Nexus Dashboard Fabric Controller that utilizes the Out-of-Band Plug and Play feature.
Can CVE-2024-20348 be exploited remotely?
Yes, CVE-2024-20348 can be exploited by an unauthenticated, remote attacker.
What type of attack does CVE-2024-20348 facilitate?
CVE-2024-20348 facilitates arbitrary file reading attacks due to an unauthenticated provisioning web server.
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- collector/the-register
- source/The Register
- alias/CVE-2024-26234
- alias/CVE-2024-29988
- alias/CVE-2024-21322
- alias/CVE-2024-21323
- alias/CVE-2024-29053
- alias/CVE-2023-41677
- alias/CVE-2023-48784
- alias/CVE-2024-23662
- alias/CVE-2024-22246
- alias/CVE-2024-20348
- agent/news-ai
- agent/weakness
- agent/severity
- agent/references
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine