Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Cisco Nexus Dashboard Fabric Controller Allows Unauthorized Command Execution

CVE-2024-20432 · published 2 years ago
Summary

A security weakness in Cisco Nexus Dashboard Fabric Controller's API and web interface allows an authorized but not powerful user to run unauthorized commands on network devices. This could lead to unauthorized changes or actions on the network. Users should update to the latest version of Cisco Nexus Dashboard Fabric Controller to fix this issue.

What to do
  • Update cisco nexus_dashboard_fabric_controller to version 12.2.2 or later.
Affected software
VendorProductAffected versions
cisco nexus_dashboard_fabric_controller >= 12.0.0, < 12.2.2
cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack agai...
A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device.
&nbsp;
This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker to execute arbitrary commands on the CLI of a Cisco NDFC-managed device with network-admin privileges.
&nbsp;
Note: This vulnerability does not affect Cisco NDFC when it is configured for storage area network (SAN) controller deployment.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published2 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-20432 · NVD
Track software like this
Free during beta