7.8
High
CVE-2024-20366 A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network…
Description
A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Network Services Orchestrator 6.2 | 6.2 → 6.2.2 | No fix stated |
| Cisco Network Services Orchestrator 6.1 | 6.1 → 6.1.7.1 | No fix stated |
| Cisco Network Services Orchestrator 6.0 | 6.0 → 6.0.11 | No fix stated |
| Cisco Network Services Orchestrator 5.8 | 5.8 → 5.8.12 | No fix stated |
| Cisco Network Services Orchestrator 5.7 | 5.7 → 5.7.15.1 | No fix stated |
| Cisco Network Services Orchestrator 5.6 | 5.6 → 5.6.14.1 | No fix stated |
| Cisco Network Services Orchestrator 5.5 | 5.5 → 5.5.10 | No fix stated |
| Cisco Network Services Orchestrator 5.4 | 5.4 → 5.4.7.1 | No fix stated |
| Cisco Network Services Orchestrator 5.3 | 5.3.1 → 5.3.4.3 | No fix stated |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Network Services Orchestrator 5.2 | 5.2.0.3 → 5.2.3.2 | No fix stated |
| Cisco Network Services Orchestrator 5.1 | 5.1.1.1 → 5.1.2 | No fix stated |
| network_services_orchestrator 5.1 | 5.1.1.1 → 6.2.2 | No fix stated |
References
- cisco-sa-nso-hcc-priv-esc-OWBWCs5D sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco Network Services Orchestrator
The 11 CVEs of Cisco Network Services Orchestrator →
CVE-2026-20188
Following the initial publication of the Security Advisory about a denial of service (DoS) condition in Cisco…
0.0
Not rated
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator…
5.3
Medium
CVE-2022-20655
A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local…
8.8
High
CVE-2024-20381
A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is…
8.8
High