CVE-2024-20366
First published: Wed May 15 2024(Updated: )
A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Crosswork Network Services Orchestrator | ||
| Cisco Network Services Orchestrator | >=5.0<5.0.5 | |
| Cisco Network Services Orchestrator | >=6.0<6.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20366?
CVE-2024-20366 is rated as a high-severity vulnerability due to its potential to allow privilege escalation to root.
Who can exploit CVE-2024-20366?
An authenticated, local attacker can exploit CVE-2024-20366 to elevate privileges on the affected device.
How do I fix CVE-2024-20366?
To mitigate CVE-2024-20366, it is recommended to apply the latest security patches provided by Cisco for Crosswork Network Services Orchestrator.
What are the potential impacts of CVE-2024-20366?
The exploitation of CVE-2024-20366 may allow an attacker to gain root privileges, leading to unauthorized access and control over the device.
Which software versions are affected by CVE-2024-20366?
CVE-2024-20366 affects Cisco Crosswork Network Services Orchestrator, but specific version details should be confirmed through Cisco's security advisory.
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/cisco
- canonical/cisco crosswork network services orchestrator
- canonical/cisco network services orchestrator
- version/cisco network services orchestrator/5.0
- version/cisco network services orchestrator/6.0