Cisco UCS Manager: CVE-2024-20397: Cisco NX-OS Software Image Verification Bypass Vulnerability

Cisco UCS Manager: CVE-2024-20397: Cisco NX-OS Software Image Verification Bypass Vulnerability

Severity

6

CVSS

(AV:L/AC:L/Au:N/C:P/I:C/A:N)

Published

12/04/2024

Created

12/06/2024

Added

12/05/2024

Modified

02/14/2025

Description

A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.

Solution(s)

• cisco-ucs-manager-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-20397
• CVE - 2024-20397
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-image-sig-bypas-pQDRQvjL
• cisco-sa-nxos-image-sig-bypas-pQDRQvjL