Skip to content

CVE-2024-20399 — Cisco NX-OS CLI Command Injection

Key facts

CVE-2024-20399 is a Critical vulnerability: Cisco NX-OS CLI Command Injection. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-07-02), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2024-20399 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-07-02), confirming exploitation in the wild. Federal remediation deadline: 2024-07-23. Prioritise patching and deploy the detection and prevention rules below.
CVE CVE-2024-20399
Severity Critical
CISA KEV Actively exploited (added 2024-07-02)
Detection / prevention —
PoC poc.py
Source 2024/CVE-2024-20399/

Details

Overview

A command injection vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device.

Vulnerability Details

  • CVE ID: CVE-2024-20399
  • CVSS Score: 9.8 (Critical)
  • CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
  • CISA KEV: Yes (Added to Known Exploited Vulnerabilities catalog)

Affected Products

  • Cisco MDS 9000 Series Multilayer Switches
  • Cisco Nexus 3000 Series Switches
  • Cisco Nexus 5500 Platform Switches
  • Cisco Nexus 5600 Platform Switches
  • Cisco Nexus 6000 Series Switches
  • Cisco Nexus 7000 Series Switches
  • Cisco Nexus 9000 Series Switches in standalone NX-OS mode

Technical Details

This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Attack Vector

  1. Attacker authenticates to device CLI with administrator credentials
  2. Attacker crafts malicious input containing shell metacharacters
  3. Crafted input is passed as argument to vulnerable CLI command
  4. Input validation fails to sanitize shell metacharacters
  5. Arbitrary commands execute in root context on underlying Linux OS

Exploitation Requirements

  • Administrative credentials required
  • Local access via CLI (SSH, Console, or NX-API)
  • NX-API enabled (for remote exploitation via API)

Proof of Concept

Usage

# Basic vulnerability check
python3 poc.py -t https://target-switch.com -c

# Version detection only (passive)
python3 poc.py -t https://target-switch.com -c --version-only

# With callback URL for OOB detection
python3 poc.py -t https://target-switch.com -c --callback http://your-server.com

Verification Methods

  1. NX-API Access Test: Checks if NX-API endpoints are accessible
  2. CLI Access Test: Tests command execution capabilities via NX-API
  3. Injection Indicator Test: Safely tests for command injection patterns
  4. OOB Callback Test: Uses out-of-band callback for confirmation

Indicators of Compromise

  • Unexpected processes running as root
  • Suspicious entries in bash history
  • Unusual network connections from switch management interface
  • Modified system files on the underlying Linux OS

Mitigation

  1. Apply Patches: Install Cisco security updates immediately
  2. Restrict Access: Limit administrative access to trusted users only
  3. Network Segmentation: Isolate management interfaces
  4. Disable NX-API: If not required, disable NX-API feature
  5. Monitor Logs: Enable and monitor command logging

References

Disclaimer

This proof of concept is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal.

Frequently asked questions

What is CVE-2024-20399?

CVE-2024-20399 is a Critical vulnerability: Cisco NX-OS CLI Command Injection. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-07-02), confirming active exploitation in the wild.

How do I detect CVE-2024-20399?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2024-20399?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Is CVE-2024-20399 actively exploited?

Yes. CVE-2024-20399 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-07-02, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2024-07-23. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.