CVE-2024-20291
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-20291
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
访问控制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Nexus 3000 Series Switches 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Nexus 3000 Series Switches是美国思科（Cisco）公司的一款3000系列交换机。 Cisco Nexus 3000 and 9000 Series Switches存在安全漏洞，该漏洞源于对端口进行配置更改时硬件编程不正确。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco NX-OS Software | 9.3(10) | - |
II. Public POCs for CVE-2024-20291
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2024-20291-POC exploit ---> RCE | https://github.com/greandfather/CVE-2024-20291-POC | POC Details |
| 2 | CVE-2024-20291-POC exploit ---> RCE | https://github.com/BetterCzz/CVE-2024-20291-POC | POC Details |
| 3 | CVE-2024-20291-POC exploit ---> RCE | https://github.com/Instructor-Team8/CVE-2024-20291-POC | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-20291
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2024-02-28 · 5 CVEs total
| CVE-2024-20267 | 8.6 HIGH | Cisco NX-OS Software 安全漏洞 |
| CVE-2024-20321 | 8.6 HIGH | Cisco NX-OS Software 安全漏洞 |
| CVE-2024-20294 | 6.6 MEDIUM | Cisco NX-OS Software和Cisco FXOS Software安全漏洞 |
| CVE-2024-20344 | 5.3 MEDIUM | Cisco UCS 6400 Series Fabric Interconnects 安全漏洞 |
IV. Related Vulnerabilities
Same product: Cisco NX-OS Software
- CVE-2026-20010
Cisco Nexus 3000 and 9000 Series Switches Link Layer Discove - CVE-2026-20051
Cisco Nexus 3600-R and 9500-R Series Switching Platforms Lay - CVE-2025-20241
Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol <TB - CVE-2025-20262
Cisco Nexus 3000 and 9000 Series Switches Protocol Independe - CVE-2025-20290
Cisco NXOS Software Sensitive Log Information Disclosure Vul
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-284
- CVE-2026-8233
Dotouch XproUPF access control - CVE-2026-42569
phpvms: /importer authorization bypass causing full database - CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr - CVE-2026-41487
Langfuse: Improper role-based-access control in Langfuse LLM - CVE-2026-42278
UltraDAG: Smart Account Spending Policy Bypass via Pockets
V. Comments for CVE-2024-20291
No comments yet