CVE-2024-20286

Summary

CVE-2024-20286 is a vulnerability in the Python interpreter of Cisco NX-OS Software that could enable an authenticated, low-privileged local attacker to escape the Python sandbox and gain unauthorized access to the device's underlying operating system. This issue arises from insufficient validation of user-supplied input, allowing an attacker to manipulate specific functions within the interpreter. A successful exploit could permit execution of arbitrary commands with the privileges of the authenticated user. To mitigate this vulnerability, organizations should refer to product-specific documentation for guidance on user privileges related to Python execution. The affected products include various models within the Cisco Nexus 9000 Series NX-OS framework, and while the base severity is classified as medium, it poses significant risks by potentially compromising system integrity and confidentiality.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.