1. Home
  2. CVE Database
  3. CVE-2024-20286
MEDIUM · 5.3

CVE-2024-20286

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlyi...

Vulnerability Description

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.  Note: An attacker must be authenticated with Python execution privileges to exploit these vulnerabilities. For more information regarding Python execution privileges, see product-specific documentation, such as the section of the Cisco Nexus 9000 Series NX-OS Programmability Guide.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
CiscoNx-Os9.3\(13\)
CiscoN9K-C92160Yc-X-
CiscoN9K-C92300Yc-
CiscoN9K-C92304Qc-
CiscoN9K-C9232C-
CiscoN9K-C92348Gc-X-
CiscoN9K-C9236C-
CiscoN9K-C9272Q-
CiscoN9K-C93108Tc-Ex-
CiscoN9K-C93108Tc-Fx-
CiscoN9K-C93120Tx-
CiscoN9K-C93128Tx-
CiscoN9K-C9316D-Gx-
CiscoN9K-C93180Lc-Ex-
CiscoN9K-C93180Yc-Ex-
CiscoN9K-C93180Yc-Fx-
CiscoN9K-C93180Yc2-Fx-
CiscoN9K-C93216Tc-Fx2-
CiscoN9K-C93240Yc-Fx2-
CiscoN9K-C9332C-

Related Weaknesses (CWE)

CWE-693

References

FAQ

What is CVE-2024-20286?

CVE-2024-20286 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlyi...

How severe is CVE-2024-20286?

CVE-2024-20286 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-20286?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nx-Os, Cisco N9K-C92160Yc-X, Cisco N9K-C92300Yc, Cisco N9K-C92304Qc, Cisco N9K-C9232C.