Cisco NDFC Path Traversal Leading to RCE (CVE-2024-20449)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability - Vulnerability ID: cisco-sa-ndfc-ptrce-BUSHLbp - CVE Number: CVE-2024-20449 - CWE Number: CWE-23 - Severity: High - Release Date: October 2, 2024 - Version: 1.0 - Workaround: No workaround available - CVSS Score: Base 8.8 2. Affected Products: - Cisco Nexus Dashboard Fabric Controller (NDFC) 3. Exploitation: - Exploitation involves uploading malicious code to the affected device using the Secure Copy Protocol (SCP) and leveraging path traversal techniques. - Successful exploitation allows an attacker to execute arbitrary code with root privileges within a specific container. 4. Remediation: - Cisco has released software updates to address this vulnerability. - No workaround is available to mitigate this vulnerability. 5. Affected Versions: - No versions of Cisco Nexus Dashboard Fabric Controller (NDFC) are affected. 6. Related Links: - Detailed security advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp 7. Security Policy: - Cisco’s security vulnerability disclosure policy and methods for obtaining security vulnerability information. 8. Rating: - Users can rate the security advisory; the current average rating is 0 stars. 9. Related Advisories: - Links to related advisories and subscription options. 10. Legal Disclaimer: - Legal disclaimer including disclaimers and copyright information. This information helps users understand the details of the vulnerability, affected products and versions, remediation steps, and how to obtain further information.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco NDFC Path Traversal Leading to RCE (CVE-2024-20449)