Cisco NX-OS CLI Command Injection Vulnerability (CVE-2024-20399) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-20399) is a command injection vulnerability (CWE-78) in the Command Line Interface (CLI) of Cisco NX-OS Software. The root cause is insufficient validation of arguments passed to specific configuration CLI commands. An attacker with administrative privileges can exploit this by inputting crafted arguments containing command separators, allowing them to escape the restricted CLI environment and execute commands directly on the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

To successfully exploit this vulnerability, an attacker must already possess valid Administrator credentials on the target device. During an active configuration session, the attacker executes a vulnerable CLI command, appending malicious OS commands using shell metacharacters (e.g., ';', '|', or backticks). Because the input is not properly sanitized, the NX-OS parser passes the payload directly to the underlying Linux shell, executing it with root privileges. Note that on devices where the bash-shell feature is already enabled and accessible to administrators (such as Nexus 3000, 9000 in standalone mode, and Nexus 7000 running 8.1(1)+), this vulnerability does not grant any additional privileges beyond what is already authorized.

3. Infrastructure & Business Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild by advanced persistent threat (APT) groups like 'Velvet Ant'. Although it requires administrative authentication, successful exploitation allows attackers to establish persistent backdoors, modify system firmware, and achieve complete control over critical network infrastructure, posing a severe threat to enterprise network integrity.