Medium severity · published Aug 28, 2024
CVE-2024-20411
Cisco NX-OS Bash Arbitrary Code Execution Vulnerability
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as root on an affected device. This vulnerability is due to insufficient security restrictions when executing commands from the Bash shell. An attacker with privileges to access the Bash shell could exploit this vulnerability by executing a specific crafted command on the underlying operating system. A successful exploit could allow the attacker to execute arbitrary code with the privileges of root.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Cisco NX-OS Software · Cisco
9.2(3); 7.0(3)I5(2); 6.0(2)A8(7a); 7.0(3)I4(5); 6.0(2)A6(1); 7.0(3)I4(6); +34 more · source: vendor
NX
Nx-os · Cisco
9.2\(3\); 7.0\(3\)i5\(2\); 6.0\(2\)a8\(7a\); 7.0\(3\)i4\(5\); 6.0\(2\)a6\(1\); 7.0\(3\)i4\(6\); +34 more · source: CISA
Affected product
CN
Cisco NX-OS Software
Cisco
More from Cisco NX-OS Software
6.7
CVE-2024-20399
Cisco NX-OS Software CLI Command Injection Vulnerability
9.8
CVE-2026-76501
Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76486
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76485
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76459
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities