CVE-2024-20397 is a bootloader vulnerability in Cisco NX-OS Software that allows an unauthenticated attacker with physical access, or an authenticated local administrator, to bypass image signature verification. This medium-severity vulnerability (CVSS 5.2) is due to insecure bootloader settings, enabling an attacker to load unverified software. While no public exploit code or active exploitation is reported, the vulnerability has garnered community attention and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Cisco | Cisco NX-OS Software | 10.1(1), 10.1(2), 10.1(2t), 10.2(1), 10.2(1q), 10.2(2), 10.2(2a), 10.2(3), 10.2(3t), 10.2(3v), 10.2(4), 10.2(5), 10.2(6), 10.2(7), 10.2(8), 10.3(1), 10.3(2), 10.3(3), 10.3(3o), 10.3(3p), 10.3(3q), 10.3(3r), 10.3(3w), 10.3(3x), 10.3(4), 10.3(4a), 10.3(4g), 10.3(4h), 10.3(5), 10.3(6), 10.3(99w), 10.3(99x), 10.4(1), 10.4(2), 10.4(3), 10.4(4), 10.4(4g), 10.5(1), 6.0(2)A8(1), 6.0(2)A8(10), 6.0(2)A8(10a), 6.0(2)A8(11), 6.0(2)A8(11a), 6.0(2)A8(11b), 6.0(2)A8(2), 6.0(2)A8(3), 6.0(2)A8(4), 6.0(2)A8(4a), 6.0(2)A8(5), 6.0(2)A8(6), 6.0(2)A8(7), 6.0(2)A8(7a), 6.0(2)A8(7b), 6.0(2)A8(8), 6.0(2)A8(9), 7.0(3)F3(1), 7.0(3)F3(2), 7.0(3)F3(3), 7.0(3)F3(3a), 7.0(3)F3(3c), 7.0(3)F3(4), 7.0(3)F3(5), 7.0(3)I4(1), 7.0(3)I4(1t), 7.0(3)I4(2), 7.0(3)I4(3), 7.0(3)I4(4), 7.0(3)I4(5), 7.0(3)I4(6), 7.0(3)I4(6t), 7.0(3)I4(7), 7.0(3)I4(8), 7.0(3)I4(8a), 7.0(3)I4(8b), 7.0(3)I4(8z), 7.0(3)I4(9), 7.0(3)I5(1), 7.0(3)I5(2), 7.0(3)I5(3), 7.0(3)I5(3a), 7.0(3)I5(3b), 7.0(3)I6(1), 7.0(3)I6(2), 7.0(3)I7(1), 7.0(3)I7(10), 7.0(3)I7(2), 7.0(3)I7(3), 7.0(3)I7(3z), 7.0(3)I7(4), 7.0(3)I7(5), 7.0(3)I7(5a), 7.0(3)I7(6), 7.0(3)I7(6z), 7.0(3)I7(7), 7.0(3)I7(8), 7.0(3)I7(9), 7.0(3)I7(9w), 7.0(3)IA7(1), 7.0(3)IA7(2), 7.0(3)IC4(4), 7.0(3)IM7(2), 7.3(0)D1(1), 7.3(0)DX(1), 7.3(0)DY(1), 7.3(1)D1(1), 7.3(1)DY(1), 7.3(2)D1(1), 7.3(2)D1(1d), 7.3(2)D1(2), 7.3(2)D1(3), 7.3(2)D1(3a), 7.3(3)D1(1), 7.3(4)D1(1), 7.3(5)D1(1), 7.3(6)D1(1), 7.3(7)D1(1), 7.3(8)D1(1), 7.3(9)D1(1), 8.1(1), 8.1(1a), 8.1(1b), 8.1(2), 8.1(2a), 8.2(1), 8.2(10), 8.2(11), 8.2(2), 8.2(3), 8.2(4), 8.2(5), 8.2(6), 8.2(7), 8.2(7a), 8.2(8), 8.2(9), 8.3(1), 8.3(2), 8.4(1), 8.4(1a), 8.4(2), 8.4(2a), 8.4(2b), 8.4(2c), 8.4(2d), 8.4(2e), 8.4(2f), 8.4(3), 8.4(4), 8.4(4a), 8.4(5), 8.4(6), 8.4(6a), 8.4(7), 8.4(8), 8.4(9), 8.5(1), 9.2(1), 9.2(1a), 9.2(2), 9.2(2t), 9.2(2v), 9.2(3), 9.2(3y), 9.2(4), 9.3(1), 9.3(10), 9.3(11), 9.3(12), 9.3(13), 9.3(14), 9.3(1z), 9.3(2), 9.3(2a), 9.3(3), 9.3(4), 9.3(5), 9.3(5w), 9.3(6), 9.3(7), 9.3(7a), 9.3(7k), 9.3(8), 9.3(9), 9.4(1), 9.4(1a)CNA affecteddefault unknown | |
| Cisco | Cisco NX-OS System Software In ACI Mode | 13.2(10e), 13.2(10f), 13.2(10g), 13.2(1l), 13.2(1m), 13.2(2l), 13.2(2o), 13.2(3i), 13.2(3j), 13.2(3n), 13.2(3o), 13.2(3r), 13.2(3s), 13.2(41d), 13.2(4d), 13.2(4e), 13.2(5d), 13.2(5e), 13.2(5f), 13.2(6i), 13.2(7f), 13.2(7k), 13.2(8d), 13.2(9b), 13.2(9f), 13.2(9h), 14.0(1h), 14.0(2c), 14.0(3c), 14.0(3d), 14.1(1i), 14.1(1j), 14.1(1k), 14.1(1l), 14.1(2g), 14.1(2m), 14.1(2o), 14.1(2s), 14.1(2u), 14.1(2w), 14.1(2x), 14.2(1i), 14.2(1j), 14.2(1l), 14.2(2e), 14.2(2f), 14.2(2g), 14.2(3j), 14.2(3l), 14.2(3n), 14.2(3q), 14.2(4i), 14.2(4k), 14.2(4o), 14.2(4p), 14.2(5k), 14.2(5l), 14.2(5n), 14.2(6d), 14.2(6g), 14.2(6h), 14.2(6l), 14.2(6o), 14.2(7f), 14.2(7l), 14.2(7q), 14.2(7r), 14.2(7s), 14.2(7t), 14.2(7u), 14.2(7v), 14.2(7w), 15.0(1k), 15.0(1l), 15.0(2e), 15.0(2h), 15.1(1h), 15.1(2e), 15.1(3e), 15.1(4c), 15.2(1g), 15.2(2e), 15.2(2f), 15.2(2g), 15.2(2h), 15.2(3e), 15.2(3f), 15.2(3g), 15.2(4d), 15.2(4e), 15.2(4f), 15.2(5c), 15.2(5d), 15.2(5e), 15.2(6e), 15.2(6g), 15.2(6h), 15.2(7f), 15.2(7g), 15.2(8d), 15.2(8e), 15.2(8f), 15.2(8g), 15.2(8h), 15.2(8i), 15.3(1d), 15.3(2a), 15.3(2b), 15.3(2c), 15.3(2d), 15.3(2e), 16.0(1g), 16.0(1j), 16.0(2h), 16.0(2j), 16.0(3d), 16.0(3e), 16.0(3g), 16.0(4c), 16.0(5h), 16.0(5j), 16.0(6c), 16.0(7e), 16.0(8e), 16.1(1f)CNA affecteddefault unknown | |
| Cisco | Cisco Unified Computing System (Managed) | 4.0(1a), 4.0(1b), 4.0(1c), 4.0(1d), 4.0(2a), 4.0(2b), 4.0(2d), 4.0(2e), 4.0(4a), 4.0(4b), 4.0(4c), 4.0(4d), 4.0(4e), 4.0(4f), 4.0(4g), 4.0(4h), 4.0(4i), 4.0(4k), 4.0(4l), 4.0(4m), 4.0(4n), 4.0(4o), 4.1(1a), 4.1(1b), 4.1(1c), 4.1(1d), 4.1(1e), 4.1(2a), 4.1(2b), 4.1(2c), 4.1(3a), 4.1(3b), 4.1(3c), 4.1(3d), 4.1(3e), 4.1(3f), 4.1(3h), 4.1(3i), 4.1(3j), 4.1(3k), 4.1(3l), 4.1(3m), 4.1(4a), 4.2(1c), 4.2(1d), 4.2(1f), 4.2(1i), 4.2(1k), 4.2(1l), 4.2(1m), 4.2(1n), 4.2(2a), 4.2(2c), 4.2(2d), 4.2(2e), 4.2(3b), 4.2(3d), 4.2(3e), 4.2(3g), 4.2(3h), 4.2(3i), 4.2(3j), 4.2(3k), 4.2(3l), 4.2(3m), 4.3(2b), 4.3(2c), 4.3(2e), 4.3(2f), 4.3(3a), 4.3(3c)CNA affecteddefault unknown |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.