Sign-up

ID

VAR-202411-2287


CVE

CVE-2024-20371


TITLE

Cisco Nexus 3500 Series Switches Permission and Access Control Issue Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-01391

DESCRIPTION

A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device.  This vulnerability exists because ACL deny rules are not properly enforced at the time of device reboot. An attacker could exploit this vulnerability by attempting to send traffic to the management interface of an affected device. A successful exploit could allow the attacker to send traffic to the management interface of the affected device. Cisco Nexus 3500 Series Switches is a 3500 series switch of Cisco

Trust: 1.44

sources: NVD: CVE-2024-20371 // CNVD: CNVD-2025-01391

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-01391

AFFECTED PRODUCTS

vendor:ciscomodel:nexus series switchesscope:eqversion:3500<1.17.2

Trust: 0.6

sources: CNVD: CNVD-2025-01391

CVSS

SEVERITY

CVSSV2

CVSSV3

ykramarz@cisco.com: CVE-2024-20371
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2025-01391
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-01391
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

ykramarz@cisco.com: CVE-2024-20371
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-01391 // NVD: CVE-2024-20371

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.0

sources: NVD: CVE-2024-20371

PATCH

title:Patch for Cisco Nexus 3500 Series Switches Permission and Access Control Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/651401

Trust: 0.6

sources: CNVD: CNVD-2025-01391

EXTERNAL IDS

db:NVDid:CVE-2024-20371

Trust: 1.6

db:CNVDid:CNVD-2025-01391

Trust: 0.6

sources: CNVD: CNVD-2025-01391 // NVD: CVE-2024-20371

REFERENCES

url:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-3550-acl-bypass-mhskzc2q

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2024-20371

Trust: 0.6

sources: CNVD: CNVD-2025-01391 // NVD: CVE-2024-20371

SOURCES

db:CNVDid:CNVD-2025-01391
db:NVDid:CVE-2024-20371

LAST UPDATE DATE

2025-02-07T23:24:04.008000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-01391date:2025-01-14T00:00:00
db:NVDid:CVE-2024-20371date:2024-11-06T18:17:17.287

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-01391date:2025-01-14T00:00:00
db:NVDid:CVE-2024-20371date:2024-11-06T17:15:14.187