7.8
Élevée
CVE-2024-20366 A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network…
Description
A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Network Services Orchestrator 6.2 | 6.2 → 6.2.2 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 6.1 | 6.1 → 6.1.7.1 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 6.0 | 6.0 → 6.0.11 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.8 | 5.8 → 5.8.12 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.7 | 5.7 → 5.7.15.1 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.6 | 5.6 → 5.6.14.1 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.5 | 5.5 → 5.5.10 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.4 | 5.4 → 5.4.7.1 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.3 | 5.3.1 → 5.3.4.3 | Pas de correctif indiqué |
Afficher les 3 autres branches Masquer les 3 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Network Services Orchestrator 5.2 | 5.2.0.3 → 5.2.3.2 | Pas de correctif indiqué |
| Cisco Network Services Orchestrator 5.1 | 5.1.1.1 → 5.1.2 | Pas de correctif indiqué |
| network_services_orchestrator 5.1 | 5.1.1.1 → 6.2.2 | Pas de correctif indiqué |
Références
- cisco-sa-nso-hcc-priv-esc-OWBWCs5D sec.cloudapps.cisco.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Cisco Network Services Orchestrator
Les 11 CVE de Cisco Network Services Orchestrator →
CVE-2026-20188
Following the initial publication of the Security Advisory about a denial of service (DoS) condition in Cisco…
0.0
Non notée
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator…
5.3
Moyenne
CVE-2022-20655
A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local…
8.8
Élevée
CVE-2024-20381
A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is…
8.8
Élevée