5.2

CVE-2024-20397: cisco cisco nx-os software Improper Access Control

CVSS: 5.2v3.1MediumDeferred
Published 04-12-2024Last modified 08-04-2025
Open JSON

Vulnerability summary

CVE-2024-20397 is a medium (CVSS 5.2) Improper Access Control vulnerability in cisco cisco nx-os software. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.2/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-12-2024
    PublishedVulnerability first disclosed.
  2. 08-04-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco3 products
  • cisco nx-os software8.2(5) | 7.3(5)D1(1) | 8.4(2) | 8.4(3) | 9.2(3) | 7.0(3)I5(2) | 8.2(1) | 6.0(2)A8(7a) | 7.0(3)I4(5) | 7.3(1)D1(1) | 7.0(3)I4(6) | 7.0(3)I4(3) | 9.2(2v) | 7.3(0)D1(1) | 7.0(3)I4(7) | 7.0(3)I4(1) | 7.0(3)I4(8) | 7.0(3)I4(2) | 6.0(2)A8(11) | 7.3(4)D1(1) | 9.2(1) | 9.2(2t) | 9.2(3y) | 7.0(3)I4(1t) | 7.0(3)I7(6z) | 9.3(2) | 7.3(1)DY(1) | 7.0(3)F3(3) | 7.0(3)I7(3z) | 7.0(3)IM7(2) | 6.0(2)A8(11b) | 7.0(3)I7(5a) | 8.1(1) | 7.0(3)I6(1) | 8.2(2) | 7.0(3)I5(3b) | 8.3(2) | 7.3(2)D1(3a) | 9.2(4) | 6.0(2)A8(10) | 6.0(2)A8(2) | 7.0(3)IC4(4) | 8.1(2) | 7.0(3)F3(3c) | 7.3(3)D1(1) | 7.0(3)F3(1) | 7.0(3)F3(5) | 8.2(3) | 7.0(3)I7(2) | 7.0(3)I5(3) | 7.0(3)I7(3) | 6.0(2)A8(6) | 7.0(3)I6(2) | 8.3(1) | 8.4(1) | 8.1(1b) | 6.0(2)A8(5) | 7.3(0)DX(1) | 7.3(2)D1(1) | 9.3(1) | 6.0(2)A8(7) | 7.0(3)I7(6) | 7.3(2)D1(2) | 6.0(2)A8(11a) | 7.0(3)I4(8z) | 7.0(3)I4(9) | 8.2(4) | 7.0(3)I7(4) | 7.0(3)I7(7) | 7.3(0)DY(1) | 6.0(2)A8(9) | 6.0(2)A8(1) | 6.0(2)A8(10a) | 7.0(3)I5(1) | 9.3(1z) | 9.2(2) | 7.0(3)F3(4) | 7.0(3)I4(8b) | 8.1(2a) | 7.3(2)D1(3) | 6.0(2)A8(3) | 7.0(3)I4(6t) | 7.0(3)I5(3a) | 8.1(1a) | 6.0(2)A8(8) | 7.0(3)I7(5) | 7.0(3)F3(3a) | 6.0(2)A8(4) | 7.0(3)I4(8a) | 7.0(3)F3(2) | 7.0(3)I4(4) | 7.0(3)I7(1) | 7.0(3)IA7(2) | 7.0(3)IA7(1) | 6.0(2)A8(7b) | 6.0(2)A8(4a) | 8.4(1a) | 9.3(3) | 7.3(2)D1(1d) | 7.0(3)I7(8) | 9.3(4) | 7.3(6)D1(1) | 8.2(6) | 9.3(5) | 8.4(2a) | 8.4(2b) | 7.0(3)I7(9) | 8.5(1) | 9.3(6) | 10.1(2) | 10.1(1) | 8.4(4) | 7.3(7)D1(1) | 8.4(2c) | 9.3(5w) | 8.2(7) | 9.3(7) | 9.3(7k) | 7.0(3)I7(9w) | 10.2(1) | 7.3(8)D1(1) | 9.3(7a) | 8.2(7a) | 9.3(8) | 8.4(4a) | 8.4(2d) | 8.4(5) | 7.0(3)I7(10) | 8.2(8) | 10.2(1q) | 10.2(2) | 9.3(9) | 10.1(2t) | 7.3(9)D1(1) | 10.2(3) | 8.4(6) | 10.2(3t) | 8.4(2e) | 9.3(10) | 10.2(2a) | 9.2(1a) | 8.2(9) | 10.3(1) | 10.2(4) | 8.4(7) | 10.3(2) | 8.4(6a) | 9.3(11) | 10.3(3) | 10.2(5) | 9.4(1) | 9.3(2a) | 8.4(2f) | 8.2(10) | 9.3(12) | 10.2(3v) | 10.4(1) | 8.4(8) | 10.3(99w) | 10.2(6) | 10.3(3w) | 10.3(99x) | 10.3(3o) | 8.4(9) | 10.3(4) | 10.3(3p) | 10.3(4a) | 9.4(1a) | 10.4(2) | 10.3(3q) | 9.3(13) | 8.2(11) | 10.3(5) | 10.2(7) | 10.4(3) | 10.3(3x) | 10.3(4g) | 10.5(1) | 10.2(8) | 10.3(3r) | 10.3(6) | 9.3(14) | 10.4(4) | 10.3(4h) | 10.4(4g)
  • cisco nx-os system software in aci mode14.1(1j) | 14.0(3d) | 14.1(1k) | 13.2(1m) | 14.0(3c) | 13.2(2l) | 13.2(7k) | 14.1(1l) | 14.2(2f) | 13.2(3s) | 13.2(2o) | 14.0(2c) | 14.1(2m) | 13.2(5e) | 14.1(2o) | 13.2(7f) | 13.2(41d) | 13.2(4d) | 13.2(3o) | 13.2(1l) | 14.0(1h) | 13.2(3n) | 14.2(1l) | 14.2(2e) | 13.2(4e) | 14.2(1i) | 13.2(9b) | 14.1(2s) | 14.1(1i) | 14.1(2g) | 13.2(3j) | 13.2(5d) | 13.2(6i) | 14.1(2u) | 13.2(3i) | 13.2(3r) | 13.2(5f) | 14.2(1j) | 14.1(2w) | 14.2(3n) | 14.2(3l) | 14.2(3j) | 14.2(2g) | 13.2(8d) | 14.1(2x) | 13.2(9f) | 14.2(3q) | 14.2(4i) | 13.2(9h) | 15.0(1k) | 14.2(4k) | 15.0(1l) | 15.0(2e) | 14.2(4o) | 14.2(4p) | 15.0(2h) | 14.2(5k) | 14.2(5l) | 14.2(5n) | 15.1(1h) | 14.2(6d) | 15.1(2e) | 14.2(6g) | 14.2(6h) | 15.1(3e) | 13.2(10e) | 14.2(6l) | 14.2(7f) | 15.1(4c) | 14.2(6o) | 15.2(1g) | 15.2(2e) | 14.2(7l) | 13.2(10f) | 15.2(2f) | 15.2(2g) | 14.2(7q) | 15.2(2h) | 15.2(3f) | 15.2(3e) | 15.2(3g) | 14.2(7r) | 14.2(7s) | 15.2(4d) | 15.2(4e) | 14.2(7t) | 15.2(5c) | 15.2(5d) | 13.2(10g) | 16.0(1g) | 14.2(7u) | 15.2(5e) | 15.2(4f) | 15.2(6e) | 15.2(6h) | 16.0(1j) | 15.2(6g) | 15.2(7f) | 14.2(7v) | 15.2(7g) | 16.0(2h) | 14.2(7w) | 15.2(8d) | 16.0(2j) | 15.2(8e) | 16.0(3d) | 16.0(3e) | 15.2(8f) | 15.2(8g) | 15.3(1d) | 15.2(8h) | 16.0(4c) | 15.3(2a) | 15.2(8i) | 16.0(5h) | 15.3(2b) | 16.0(3g) | 16.0(5j) | 15.3(2c) | 16.0(6c) | 15.3(2d) | 16.1(1f) | 16.0(7e) | 16.0(8e) | 15.3(2e)
  • cisco unified computing system (managed)4.0(4c) | 4.0(2b) | 4.1(2a) | 4.0(1a) | 4.0(2a) | 4.0(1b) | 4.1(1c) | 4.0(4a) | 4.0(4b) | 4.0(2e) | 4.1(1a) | 4.0(4d) | 4.0(4h) | 4.0(4g) | 4.0(1d) | 4.1(1e) | 4.0(4f) | 4.0(4e) | 4.0(4i) | 4.1(1d) | 4.0(2d) | 4.1(1b) | 4.0(1c) | 4.1(2b) | 4.0(4k) | 4.1(3a) | 4.1(3b) | 4.1(2c) | 4.0(4l) | 4.1(4a) | 4.1(3c) | 4.1(3d) | 4.2(1c) | 4.2(1d) | 4.0(4m) | 4.1(3e) | 4.2(1f) | 4.1(3f) | 4.2(1i) | 4.1(3h) | 4.2(1k) | 4.2(1l) | 4.0(4n) | 4.2(1m) | 4.1(3i) | 4.2(2a) | 4.2(1n) | 4.1(3j) | 4.2(2c) | 4.2(2d) | 4.2(3b) | 4.1(3k) | 4.0(4o) | 4.2(2e) | 4.2(3d) | 4.2(3e) | 4.2(3g) | 4.1(3l) | 4.3(2b) | 4.2(3h) | 4.2(3i) | 4.3(2c) | 4.1(3m) | 4.3(2e) | 4.3(3a) | 4.2(3j) | 4.3(3c) | 4.2(3k) | 4.2(3l) | 4.3(2f) | 4.2(3m)

1 vendor · 3 products

References

1 links