Cisco Nexus 3550-F ACL Bypass Vulnerability (CVE-2024-20371) Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability - Vulnerability ID: cisco-sa-3550-acl-bypass-mhskZc2q - CVE Number: CVE-2024-20371 - CVSS Score: Base 5.3 2. Affected Products: - Affected Product: Cisco Nexus 3550-F Switches - Affected Software Versions: 1.17.1 and earlier versions 3. Vulnerability Impact: - Description: A vulnerability exists in the Access Control List (ACL) programming of Cisco Nexus 3550-F Switches, allowing unauthorized remote attackers to send traffic destined for the management interface that should be blocked. - Cause: ACL deny rules are not properly enforced after device reboot. - Exploitation: Attackers can exploit this vulnerability by attempting to send traffic to the management interface of the affected device. Successful exploitation allows attackers to send traffic to the management interface of the affected device. 4. Remediation: - Fix Released: Cisco has released software updates to address this vulnerability. No workarounds are available. - Affected Software Version: 1.17.2 5. Affected Products: - Affected Product: Cisco Nexus 3550-F Switches - Affected Software Versions: 1.17.1 and earlier versions 6. Workarounds: - Workarounds: No workarounds are available for this vulnerability. 7. Related Links: - Cisco Security Vulnerability Policy: Link to the page detailing Cisco’s security vulnerability disclosure policy and publications. - Subscribe to Cisco Security Notifications: Link to the page for subscribing to Cisco security notifications. - Related Vulnerabilities: Link to a page listing other vulnerabilities related to this one. 8. Rating: - Average Rating: 5 stars - User Rating: 0 9. Source: - Discovery Source: Discovered during the resolution of a Cisco TAC support case. 10. URL: - Vulnerability Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-3550-acl-bypass-mhskZc2q 11. Revision History: - Revision History: Includes version, description, status, and date. 12. Legal Disclaimer: - Disclaimer: This document is provided "AS IS" without any warranty or guarantee, including but not limited to implied warranties of merchantability or fitness for a particular purpose. The risk of using this document or any material linked to it is solely the user’s responsibility. Cisco reserves the right to modify or update this document at any time. This information helps users understand the vulnerability details, affected products and software versions, remediation steps, and how to obtain further information.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Nexus 3550-F ACL Bypass Vulnerability (CVE-2024-20371) Advisory