WID-SEC-W-2024-1949

Vulnerability from csaf_certbund - Published: 2024-08-28 22:00 - Updated: 2024-08-28 22:00
Summary
Cisco NX-OS: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Cisco NX-OS ist ein Data Center Netzwerk-Betriebssystem für virtualisierte Rechenzentren. NX-OS wurde für Ethernet Switches der Nexus Serie und Fibre Channel Storage Area Network Swiches der MDS Serie entwickelt.
Angriff: Ein lokaler oder entfernter, anonymer Angreifer kann mehrere Schwachstellen in Cisco NX-OS ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Rechte zu erlangen und einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme: - CISCO Appliance
CVE-2024-20284
Affected products
Product Identifier Version Remediation
Cisco Unified Computing System (UCS) 6400
Cisco / Unified Computing System (UCS)
 cpe:/h:cisco:unified_computing_system:6400 6400
Cisco Nexus 6000
Cisco / Nexus
 cpe:/h:cisco:nexus:6000 6000
Cisco NX-OS
Cisco
 cpe:/o:cisco:nx-os:- —
Cisco Nexus 3000
Cisco / Nexus
 cpe:/h:cisco:nexus:3000 3000
Cisco Nexus 7000
Cisco / Nexus
 cpe:/h:cisco:nexus:7000 7000
Cisco Nexus 9000
Cisco / Nexus
 cpe:/h:cisco:nexus:9000 9000
Cisco Nexus 5500
Cisco / Nexus
 cpe:/h:cisco:nexus:5500 5500
Cisco Unified Computing System (UCS) 6500
Cisco / Unified Computing System (UCS)
 cpe:/h:cisco:unified_computing_system:6500 6500
Cisco MDS 9000
Cisco
 cpe:/o:cisco:mds_9000:- —
Cisco Nexus 5600
Cisco / Nexus
 cpe:/h:cisco:nexus:5600 5600
CVE-2024-20285
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
CVE-2024-20286
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
CVE-2024-20289
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
CVE-2024-20411
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
CVE-2024-20413
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
CVE-2024-20446
Affected products
Known affected 10 products, the same list as for CVE-2024-20284
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Cisco NX-OS ist ein Data Center Netzwerk-Betriebssystem f\u00fcr virtualisierte Rechenzentren. NX-OS wurde f\u00fcr Ethernet Switches der Nexus Serie und Fibre Channel Storage Area Network Swiches der MDS Serie entwickelt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler oder entfernter, anonymer Angreifer kann mehrere Schwachstellen in Cisco NX-OS ausnutzen, um beliebigen Programmcode auszuf\u00fchren, erweiterte Rechte zu erlangen und einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1949 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1949.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1949 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1949"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-nxos-bshacepe-bApeHSx7 vom 2024-08-28",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-bshacepe-bApeHSx7"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-nxos-cmdinj-Lq6jsZhH vom 2024-08-28",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-Lq6jsZhH"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-nxos-dhcp6-relay-dos-znEAA6xn vom 2024-08-28",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-dhcp6-relay-dos-znEAA6xn"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-nxos-psbe-ce-YvbTn5du vom 2024-08-28",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-psbe-ce-YvbTn5du"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco NX-OS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-08-28T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T17:08:33.796+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2024-1949",
      "initial_release_date": "2024-08-28T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-28T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Cisco MDS 9000",
            "product": {
              "name": "Cisco MDS 9000",
              "product_id": "T001069",
              "product_identification_helper": {
                "cpe": "cpe:/o:cisco:mds_9000:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco NX-OS",
            "product": {
              "name": "Cisco NX-OS",
              "product_id": "T035723",
              "product_identification_helper": {
                "cpe": "cpe:/o:cisco:nx-os:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3000",
                "product": {
                  "name": "Cisco Nexus 3000",
                  "product_id": "T003851",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:3000"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9000",
                "product": {
                  "name": "Cisco Nexus 9000",
                  "product_id": "T003853",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:9000"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7000",
                "product": {
                  "name": "Cisco Nexus 7000",
                  "product_id": "T009516",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:7000"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5500",
                "product": {
                  "name": "Cisco Nexus 5500",
                  "product_id": "T010049",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:5500"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5600",
                "product": {
                  "name": "Cisco Nexus 5600",
                  "product_id": "T010052",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:5600"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "6000",
                "product": {
                  "name": "Cisco Nexus 6000",
                  "product_id": "T026491",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:nexus:6000"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Nexus"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6400",
                "product": {
                  "name": "Cisco Unified Computing System (UCS) 6400",
                  "product_id": "T013716",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:unified_computing_system:6400"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "6500",
                "product": {
                  "name": "Cisco Unified Computing System (UCS) 6500",
                  "product_id": "T037182",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:unified_computing_system:6500"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Unified Computing System (UCS)"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20284",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20284"
    },
    {
      "cve": "CVE-2024-20285",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20285"
    },
    {
      "cve": "CVE-2024-20286",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20286"
    },
    {
      "cve": "CVE-2024-20289",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20289"
    },
    {
      "cve": "CVE-2024-20411",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20411"
    },
    {
      "cve": "CVE-2024-20413",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20413"
    },
    {
      "cve": "CVE-2024-20446",
      "product_status": {
        "known_affected": [
          "T013716",
          "T026491",
          "T035723",
          "T003851",
          "T009516",
          "T003853",
          "T010049",
          "T037182",
          "T001069",
          "T010052"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-20446"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.