CVE-2024-20444
Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability
Description
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.
Weakness: CWE-88
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Data Center Network Manager | Network & Security Management | cna-assigner |
Vendor-reported products (2)
- Cisco · Cisco Data Center Network Manager
- cisco · data_center_network_manager
Vendor advisory
Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability
Cisco’s rating: Medium (advisory CVSS 5.5) · Published Oct 2, 2024
Bug ID: CSCwj55173
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from