CVE-2024-20449: Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques. A successful exploit could allow the attacker to execute arbitrary code in a specific container with the privileges of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20449?
CVE-2024-20449 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2024-20449?
To fix CVE-2024-20449, update the Cisco Nexus Dashboard Fabric Controller to a version that is not vulnerable, specifically beyond 12.2.2.
Who is affected by CVE-2024-20449?
CVE-2024-20449 affects devices running Cisco Nexus Dashboard Fabric Controller versions from 12.0.0 to 12.2.2.
What type of attack is possible with CVE-2024-20449?
An authenticated remote attacker with low privileges can exploit CVE-2024-20449 to execute arbitrary code on the affected device.
Is CVE-2024-20449 easy to exploit?
CVE-2024-20449 can be exploited with specific knowledge of the affected system's path validation flaws, making it a risk for targeted attacks.