ZDI-22-506: Cisco Nexus Dashboard Fabric Controller AMF Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AMF protocol. Crafted data in an AMF protocol message can trigger the deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the fmserver user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-506?
The severity of ZDI-22-506 is high due to its potential for remote code execution without authentication.
How do I fix ZDI-22-506?
To fix ZDI-22-506, apply the latest patch provided by Cisco for the Nexus Dashboard Fabric Controller.
What is affected by ZDI-22-506?
ZDI-22-506 affects the Cisco Nexus Dashboard Fabric Controller software.
Is authentication required to exploit ZDI-22-506?
No, authentication is not required to exploit ZDI-22-506, making it particularly dangerous.
What type of attack does ZDI-22-506 enable?
ZDI-22-506 enables remote attackers to execute arbitrary code on vulnerable systems.