CVE-2024-20399: Cisco NX-OS CLI command injection allows root command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw requires Administrator credentials but yields root on network devices and is confirmed exploited in the wild per CISA KEV.

What it is

Cisco NX-OS fails to properly validate arguments passed to specific configuration CLI commands, allowing OS command injection. An attacker who already holds Administrator credentials can inject crafted input to run arbitrary commands as root on the underlying operating system. The flaw matters because it converts administrative CLI access into full root-level control of the device.

Impact

An attacker with Administrator credentials gains root-level command execution on the underlying NX-OS operating system, enabling full device compromise. On devices that already expose bash-shell to admins, the flaw grants no additional privilege.

Attack surface

Reached locally through the NX-OS CLI by supplying crafted arguments to affected configuration commands. Authentication is required at Administrator privilege level; no user interaction is needed.

Exploitation

CVE-2024-20399 is listed in CISA KEV with a due date of 2024-07-23, indicating known exploitation in the wild. EPSS is 0.04306 (90.6th percentile), and a third-party advisory links it to a China-nexus threat group exploiting it as a zero-day.

What to do

• Apply the Cisco NX-OS software updates referenced in the vendor advisory cisco-sa-nxos-cmd-injection-xD9OhyOP.
• If patching is not immediately possible, follow Cisco's documented workarounds or discontinue use of the affected product per CISA guidance.
• Restrict and audit Administrator-level CLI accounts; remove unnecessary admin credentials and enforce least privilege.
• Monitor and limit management-plane access to trusted networks and administrative hosts.

Detection

• Review NX-OS CLI command logs for configuration commands containing shell metacharacters or unexpected argument strings.
• Alert on Administrator account activity outside normal change windows or from unusual source addresses.
• Hunt for unexpected root-level processes or files on NX-OS devices that indicate command execution via the CLI.
• Correlate device logs with management-plane authentication events to spot credential misuse preceding command injection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.