{"id":"CVE-2024-20399","published":"2024-07-01T17:15:04Z","modified":"2026-06-17T07:06:56Z","title":"Cisco NX-OS Command Injection Vulnerability","vendor":"Cisco","product":"NX-OS","tier":"core","eol":null,"description":{"text":"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.\r\nNote: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges:\r\n\r\nNexus 3000 Series Switches\r\nNexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later\r\nNexus 9000 Series Switches in standalone NX-OS mode","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a command injection vulnerability in the CLI of Cisco NX-OS Software, caused by insufficient validation of arguments passed to certain configuration CLI commands. An attacker who holds Administrator credentials on an affected device can use crafted input in those commands to run arbitrary commands as root on the underlying operating system; the attack requires local access to the CLI and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:14Z"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.04306,"percentile":0.91139,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-07-02","dueDate":"2024-07-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP;   https://nvd.nist.gov/vuln/detail/CVE-2024-20399","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-07-01","exploitedFirstSeen":"2024-07-01","ransomware":false,"evidence":[{"url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/","date":"2024-07-01"},{"url":"https://www.zero-day.cz/database/894/","date":"2024-07-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-07-02"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP","date":"2024-07-03"},{"url":"https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-os-command-injection-vulnerabilities","date":"2024-07-10"},{"url":"https://www.tenable.com/blog/cybersecurity-snapshot-cisa-tells-tech-vendors-to-squash-command-injection-bugs-as-openssf","date":"2024-07-12"},{"url":"https://eclypsium.com/wp-content/uploads/Eclypsium-Threat-Report-Summer-2024.pdf","date":"2024-07-18"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/08/06/2024-midyear-threat-landscape-review","date":"2024-08-06"},{"url":"https://www.sygnia.co/blog/china-threat-group-velvet-ant-cisco-zero-day/","date":"2024-08-22"},{"url":"https://eclypsium.com/blog/squashing-the-velvet-ant-how-eclypsium-protects-cisco-nx-os-and-f5-load-balancers/","date":"2024-09-04"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP","tags":["Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP","tags":["Vendor Advisory"]},{"url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20399","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges. ","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges. ","confidence":"high"}],"reports":[{"id":"SRC-d6831d4223ab36771b1a","title":"Weathering the storm: In the midst of a Typhoon","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","date":"2025-02-20","mentions":[{"quote":"CVE-2024-20399 - Cisco NX-OS Software CLI Command Injection Vulnerability (Last Updated: 17-Sep-2024)","start":2475,"end":2576}]},{"id":"SRC-3cc250edc3b166417b0f","title":"In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization","publisher":"sygnia.co","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/","date":"2024-06-03","mentions":[{"quote":"China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response","start":28395,"end":28547}]},{"id":"SRC-93751f8c8ac64a7035ca","title":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","publisher":"sygnia.co","url":"https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/","date":"2022-10-03","mentions":[{"quote":"China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response","start":20922,"end":21074}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-18114","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18114","exploited":true,"exploitedSince":"2024-07-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-17","earliestUrl":"https://github.com/HORKimhab/CVE-2024-20399","repos":[{"name":"HORKimhab/CVE-2024-20399","url":"https://github.com/HORKimhab/CVE-2024-20399","stars":0,"created":"2026-06-17"}]},"first":{"date":"2026-06-17","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2024-20399"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2022-10-03","kind":"report","label":"Named in sygnia.co: Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/","provenance":"machine"},{"date":"2024-06-03","kind":"report","label":"Named in sygnia.co: In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/","provenance":"machine"},{"date":"2024-07-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20399","provenance":"source"},{"date":"2024-07-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/","provenance":"source"},{"date":"2024-07-02","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-07-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18114","provenance":"source"},{"date":"2025-02-20","kind":"report","label":"Named in blog.talosintelligence.com: Weathering the storm: In the midst of a Typhoon","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","provenance":"machine"},{"date":"2026-06-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2024-20399","provenance":"source"}],"speed":{"daysToPublicExploit":716,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 852 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.23,"detail":"percentile 0.9114"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.69,"detail":"base score 6.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-nx-os-cwe-78"}}