8.8
CWE
285
Advisory Published
Updated

CVE-2024-20381: Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability

First published: Wed Sep 11 2024(Updated: )

A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.  This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

Credit: ykramarz@cisco.com

Affected SoftwareAffected VersionHow to fix
Cisco IOS XRv 9000=6.5.1
Cisco IOS XRv 9000=6.5.2
Cisco IOS XRv 9000=6.5.3
Cisco IOS XRv 9000=6.5.15
Cisco IOS XRv 9000=6.5.25
Cisco IOS XRv 9000=6.5.26
Cisco IOS XRv 9000=6.5.28
Cisco IOS XRv 9000=6.5.29
Cisco IOS XRv 9000=6.5.31
Cisco IOS XRv 9000=6.5.32
Cisco IOS XRv 9000=6.5.33
Cisco IOS XRv 9000=6.5.90
Cisco IOS XRv 9000=6.5.92
Cisco IOS XRv 9000=6.5.93
Cisco IOS XRv 9000=6.6.1
Cisco IOS XRv 9000=6.6.2
Cisco IOS XRv 9000=6.6.3
Cisco IOS XRv 9000=6.6.4
Cisco IOS XRv 9000=6.6.11
Cisco IOS XRv 9000=6.6.12
Cisco IOS XRv 9000=6.6.25
Cisco IOS XRv 9000=6.7.1
Cisco IOS XRv 9000=6.7.2
Cisco IOS XRv 9000=6.7.3
Cisco IOS XRv 9000=6.7.4
Cisco IOS XRv 9000=6.7.35
Cisco IOS XRv 9000=6.8.1
Cisco IOS XRv 9000=6.8.2
Cisco IOS XRv 9000=6.9.1
Cisco IOS XRv 9000=6.9.2
Cisco IOS XRv 9000=7.0.0
Cisco IOS XRv 9000=7.0.1
Cisco IOS XRv 9000=7.0.2
Cisco IOS XRv 9000=7.0.11
Cisco IOS XRv 9000=7.0.12
Cisco IOS XRv 9000=7.0.14
Cisco IOS XRv 9000=7.0.90
Cisco IOS XRv 9000=7.1.1
Cisco IOS XRv 9000=7.1.2
Cisco IOS XRv 9000=7.1.3
Cisco IOS XRv 9000=7.1.15
Cisco IOS XRv 9000=7.1.25
Cisco IOS XRv 9000=7.2.0
Cisco IOS XRv 9000=7.2.1
Cisco IOS XRv 9000=7.2.2
Cisco IOS XRv 9000=7.2.12
Cisco IOS XRv 9000=7.3.1
Cisco IOS XRv 9000=7.3.2
Cisco IOS XRv 9000=7.3.3
Cisco IOS XRv 9000=7.3.4
Cisco IOS XRv 9000=7.3.5
Cisco IOS XRv 9000=7.3.6
Cisco IOS XRv 9000=7.3.15
Cisco IOS XRv 9000=7.3.16
Cisco IOS XRv 9000=7.3.27
Cisco IOS XRv 9000=7.4.1
Cisco IOS XRv 9000=7.4.2
Cisco IOS XRv 9000=7.4.15
Cisco IOS XRv 9000=7.4.16
Cisco IOS XRv 9000=7.5.1
Cisco IOS XRv 9000=7.5.2
Cisco IOS XRv 9000=7.5.3
Cisco IOS XRv 9000=7.5.4
Cisco IOS XRv 9000=7.5.5
Cisco IOS XRv 9000=7.5.12
Cisco IOS XRv 9000=7.5.52
Cisco IOS XRv 9000=7.6.1
Cisco IOS XRv 9000=7.6.2
Cisco IOS XRv 9000=7.6.3
Cisco IOS XRv 9000=7.6.15
Cisco IOS XRv 9000=7.7.1
Cisco IOS XRv 9000=7.7.2
Cisco IOS XRv 9000=7.7.21
Cisco IOS XRv 9000=7.8.1
Cisco IOS XRv 9000=7.8.2
Cisco IOS XRv 9000=7.8.12
Cisco IOS XRv 9000=7.8.22
Cisco IOS XRv 9000=7.9.1
Cisco IOS XRv 9000=7.9.2
Cisco IOS XRv 9000=7.9.21
Cisco IOS XRv 9000=7.10.1
Cisco IOS XRv 9000=7.10.2
Cisco IOS XRv 9000=7.11.1
Cisco IOS XRv 9000=7.11.2
Cisco IOS XRv 9000=24.1.1
Cisco IOS XRv 9000=24.1.2
Cisco IOS XRv 9000=24.2.1
Cisco IOS XRv 9000=24.2.11
Cisco Network Services Orchestrator=4.4.1
Cisco Network Services Orchestrator=4.5.1
Cisco Network Services Orchestrator=4.7.1
Cisco Network Services Orchestrator=4.7.3
Cisco Network Services Orchestrator=5.1.1.1
Cisco Network Services Orchestrator=5.1.1.3
Cisco Network Services Orchestrator=5.1.2
Cisco Network Services Orchestrator=5.1.4.3
Cisco Network Services Orchestrator=5.2.0.3
Cisco Network Services Orchestrator=5.2.0.4
Cisco Network Services Orchestrator=5.2.1
Cisco Network Services Orchestrator=5.2.1.1
Cisco Network Services Orchestrator=5.2.3.2
Cisco Network Services Orchestrator=5.3.1
Cisco Network Services Orchestrator=5.3.4.3
Cisco Network Services Orchestrator=5.4
Cisco Network Services Orchestrator=5.4.0.1
Cisco Network Services Orchestrator=5.4.0.2
Cisco Network Services Orchestrator=5.4.1
Cisco Network Services Orchestrator=5.4.1.1
Cisco Network Services Orchestrator=5.4.2
Cisco Network Services Orchestrator=5.4.2.1
Cisco Network Services Orchestrator=5.4.2.2
Cisco Network Services Orchestrator=5.4.3
Cisco Network Services Orchestrator=5.4.3.1
Cisco Network Services Orchestrator=5.4.3.2
Cisco Network Services Orchestrator=5.4.3.3
Cisco Network Services Orchestrator=5.4.3.4
Cisco Network Services Orchestrator=5.4.4
Cisco Network Services Orchestrator=5.4.4.1
Cisco Network Services Orchestrator=5.4.4.2
Cisco Network Services Orchestrator=5.4.4.3
Cisco Network Services Orchestrator=5.4.5
Cisco Network Services Orchestrator=5.4.5.1
Cisco Network Services Orchestrator=5.4.5.2
Cisco Network Services Orchestrator=5.4.6
Cisco Network Services Orchestrator=5.4.7
Cisco Network Services Orchestrator=5.4.7.1
Cisco Network Services Orchestrator=5.5
Cisco Network Services Orchestrator=5.5.1
Cisco Network Services Orchestrator=5.5.2
Cisco Network Services Orchestrator=5.5.2.1
Cisco Network Services Orchestrator=5.5.2.2
Cisco Network Services Orchestrator=5.5.2.3
Cisco Network Services Orchestrator=5.5.2.4
Cisco Network Services Orchestrator=5.5.2.5
Cisco Network Services Orchestrator=5.5.2.6
Cisco Network Services Orchestrator=5.5.2.7
Cisco Network Services Orchestrator=5.5.2.8
Cisco Network Services Orchestrator=5.5.2.9
Cisco Network Services Orchestrator=5.5.2.10
Cisco Network Services Orchestrator=5.5.2.11
Cisco Network Services Orchestrator=5.5.2.12
Cisco Network Services Orchestrator=5.5.3
Cisco Network Services Orchestrator=5.5.3.1
Cisco Network Services Orchestrator=5.5.4
Cisco Network Services Orchestrator=5.5.4.1
Cisco Network Services Orchestrator=5.5.5
Cisco Network Services Orchestrator=5.5.6
Cisco Network Services Orchestrator=5.5.6.1
Cisco Network Services Orchestrator=5.5.7
Cisco Network Services Orchestrator=5.5.8
Cisco Network Services Orchestrator=5.5.9
Cisco Network Services Orchestrator=5.5.10
Cisco Network Services Orchestrator=5.6
Cisco Network Services Orchestrator=5.6.1
Cisco Network Services Orchestrator=5.6.2
Cisco Network Services Orchestrator=5.6.3
Cisco Network Services Orchestrator=5.6.3.1
Cisco Network Services Orchestrator=5.6.4
Cisco Network Services Orchestrator=5.6.5
Cisco Network Services Orchestrator=5.6.6
Cisco Network Services Orchestrator=5.6.6.1
Cisco Network Services Orchestrator=5.6.7
Cisco Network Services Orchestrator=5.6.7.1
Cisco Network Services Orchestrator=5.6.7.2
Cisco Network Services Orchestrator=5.6.8
Cisco Network Services Orchestrator=5.6.8.1
Cisco Network Services Orchestrator=5.6.9
Cisco Network Services Orchestrator=5.6.10
Cisco Network Services Orchestrator=5.6.11
Cisco Network Services Orchestrator=5.6.12
Cisco Network Services Orchestrator=5.6.13
Cisco Network Services Orchestrator=5.6.14
Cisco Network Services Orchestrator=5.6.14.1
Cisco Network Services Orchestrator=5.7
Cisco Network Services Orchestrator=5.7.1
Cisco Network Services Orchestrator=5.7.1.1
Cisco Network Services Orchestrator=5.7.2
Cisco Network Services Orchestrator=5.7.2.1
Cisco Network Services Orchestrator=5.7.3
Cisco Network Services Orchestrator=5.7.4
Cisco Network Services Orchestrator=5.7.5
Cisco Network Services Orchestrator=5.7.5.1
Cisco Network Services Orchestrator=5.7.6
Cisco Network Services Orchestrator=5.7.6.1
Cisco Network Services Orchestrator=5.7.6.2
Cisco Network Services Orchestrator=5.7.6.3
Cisco Network Services Orchestrator=5.7.7
Cisco Network Services Orchestrator=5.7.8
Cisco Network Services Orchestrator=5.7.8.1
Cisco Network Services Orchestrator=5.7.9
Cisco Network Services Orchestrator=5.7.9.1
Cisco Network Services Orchestrator=5.7.10
Cisco Network Services Orchestrator=5.7.10.1
Cisco Network Services Orchestrator=5.7.10.2
Cisco Network Services Orchestrator=5.7.11
Cisco Network Services Orchestrator=5.7.12
Cisco Network Services Orchestrator=5.7.13
Cisco Network Services Orchestrator=5.7.14
Cisco Network Services Orchestrator=5.7.15
Cisco Network Services Orchestrator=5.7.15.1
Cisco Network Services Orchestrator=5.7.17
Cisco Network Services Orchestrator=5.8
Cisco Network Services Orchestrator=5.8.1
Cisco Network Services Orchestrator=5.8.2
Cisco Network Services Orchestrator=5.8.2.1
Cisco Network Services Orchestrator=5.8.3
Cisco Network Services Orchestrator=5.8.4
Cisco Network Services Orchestrator=5.8.5
Cisco Network Services Orchestrator=5.8.6
Cisco Network Services Orchestrator=5.8.7
Cisco Network Services Orchestrator=5.8.8
Cisco Network Services Orchestrator=5.8.9
Cisco Network Services Orchestrator=5.8.10
Cisco Network Services Orchestrator=5.8.11
Cisco Network Services Orchestrator=5.8.12
Cisco Network Services Orchestrator=5.8.13
Cisco Network Services Orchestrator=6.0
Cisco Network Services Orchestrator=6.0.1
Cisco Network Services Orchestrator=6.0.1.1
Cisco Network Services Orchestrator=6.0.2
Cisco Network Services Orchestrator=6.0.3
Cisco Network Services Orchestrator=6.0.4
Cisco Network Services Orchestrator=6.0.5
Cisco Network Services Orchestrator=6.0.6
Cisco Network Services Orchestrator=6.0.7
Cisco Network Services Orchestrator=6.0.8
Cisco Network Services Orchestrator=6.0.9
Cisco Network Services Orchestrator=6.0.10
Cisco Network Services Orchestrator=6.0.11
Cisco Network Services Orchestrator=6.0.12
Cisco Network Services Orchestrator=6.1
Cisco Network Services Orchestrator=6.1.1
Cisco Network Services Orchestrator=6.1.2
Cisco Network Services Orchestrator=6.1.2.1
Cisco Network Services Orchestrator=6.1.3
Cisco Network Services Orchestrator=6.1.3.1
Cisco Network Services Orchestrator=6.1.3.2
Cisco Network Services Orchestrator=6.1.4
Cisco Network Services Orchestrator=6.1.5
Cisco Network Services Orchestrator=6.1.6
Cisco Network Services Orchestrator=6.1.6.1
Cisco Network Services Orchestrator=6.1.7
Cisco Network Services Orchestrator=6.1.7.1
Cisco Network Services Orchestrator=6.1.8
Cisco Network Services Orchestrator=6.1.10
Cisco Network Services Orchestrator=6.1.11
Cisco Network Services Orchestrator=6.1.11.1
Cisco Network Services Orchestrator=6.1.11.2
Cisco Network Services Orchestrator=6.1.12
Cisco Network Services Orchestrator=6.2
Cisco Network Services Orchestrator=6.2.2
Cisco RV Series Router Firmware=1.0.00.29
Cisco RV Series Router Firmware=1.0.00.33
Cisco RV Series Router Firmware=1.0.01.16
Cisco RV Series Router Firmware=1.0.01.17
Cisco RV Series Router Firmware=1.0.01.18
Cisco RV Series Router Firmware=1.0.01.20
Cisco RV Series Router Firmware=1.0.02.16
Cisco RV Series Router Firmware=1.0.03.15
Cisco RV Series Router Firmware=1.0.03.16
Cisco RV Series Router Firmware=1.0.03.17
Cisco RV Series Router Firmware=1.0.03.18
Cisco RV Series Router Firmware=1.0.03.19
Cisco RV Series Router Firmware=1.0.03.20
Cisco RV Series Router Firmware=1.0.03.21
Cisco RV Series Router Firmware=1.0.03.22
Cisco RV Series Router Firmware=1.0.03.24
Cisco RV Series Router Firmware=1.0.03.26
Cisco RV Series Router Firmware=1.0.03.27
Cisco RV Series Router Firmware=1.0.03.28
Cisco RV Series Router Firmware=1.0.03.29

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2024-20381?

    CVE-2024-20381 has been classified with a severity level that indicates it poses a significant risk for authenticated remote attackers.

  • How do I fix CVE-2024-20381?

    To remediate CVE-2024-20381, updating the affected Cisco devices to the latest version provided by Cisco is essential.

  • Which Cisco products are affected by CVE-2024-20381?

    CVE-2024-20381 affects various versions of Cisco IOS XR, Cisco Crosswork Network Services Orchestrator, and Cisco RV340 Dual WAN Gigabit VPN Routers.

  • What is the impact of CVE-2024-20381 on affected systems?

    CVE-2024-20381 could allow an authenticated, remote attacker to leverage a JSON-RPC API feature for unauthorized access or control over the device.

  • Are there any workarounds for CVE-2024-20381?

    Currently, no specific workarounds are recommended for mitigating the risks associated with CVE-2024-20381 outside of applying the necessary updates.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203