CVE-2024-20371 — Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability

Description (CNA)

A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device.  This vulnerability exists because ACL deny rules are not properly enforced at the time of device reboot. An attacker could exploit this vulnerability by attempting to send traffic to the management interface of an affected device. A successful exploit could allow the attacker to send traffic to the management interface of the affected device.

Affected (CNA)

Vendor / product	Versions
Cisco / Cisco Nexus 3550 System Software	affected 3550-F_1.11.3; affected 3550-F_1.12.0; affected 3550-F_1.16.0; affected 3550-F_1.17.1; affected 3550-F_1.11.1; affected 3550-F_1.11.2; affected 3550-F_1.15.0; affected 3550-F_1.13.0; affected 3550-F_1.14.0

CWE

CWE-264

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-3550-acl-bypass-mhskZc2q

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.