TI-2024-13330 Aliases CVE-2024-20397 GHSA-p5rq-7r6m-x7rf

Cisco NX-OS Software Image Verification Bypass Vulnerability

LOW 23CWE-284Published 2024-12-04 · Updated 2025-04-08

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.  This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco NX-OS Software	8.2(5); 7.3(5)D1(1); 8.4(2); 8.4(3); 9.2(3); 7.0(3)I5(2); 8.2(1); 6.0(2)A8(7a); 7.0(3)I4(5); 7.3(1)D1(1); 7.0(3)I4(6); 7.0(3)I4(3); 9.2(2v); 7.3(0)D1(1); 7.0(3)I4(7); 7.0(3)I4(1); 7.0(3)I4(8); 7.0(3)I4(2); 6.0(2)A8(11); 7.3(4)D1(1); 9.2(1); 9.2(2t); 9.2(3y); 7.0(3)I4(1t); 7.0(3)I7(6z); 9.3(2); 7.3(1)DY(1); 7.0(3)F3(3); 7.0(3)I7(3z); 7.0(3)IM7(2); 6.0(2)A8(11b); 7.0(3)I7(5a); 8.1(1); 7.0(3)I6(1); 8.2(2); 7.0(3)I5(3b); 8.3(2); 7.3(2)D1(3a); 9.2(4); 6.0(2)A8(10); 6.0(2)A8(2); 7.0(3)IC4(4); 8.1(2); 7.0(3)F3(3c); 7.3(3)D1(1); 7.0(3)F3(1); 7.0(3)F3(5); 8.2(3); 7.0(3)I7(2); 7.0(3)I5(3); 7.0(3)I7(3); 6.0(2)A8(6); 7.0(3)I6(2); 8.3(1); 8.4(1); 8.1(1b); 6.0(2)A8(5); 7.3(0)DX(1); 7.3(2)D1(1); 9.3(1); 6.0(2)A8(7); 7.0(3)I7(6); 7.3(2)D1(2); 6.0(2)A8(11a); 7.0(3)I4(8z); 7.0(3)I4(9); 8.2(4); 7.0(3)I7(4); 7.0(3)I7(7); 7.3(0)DY(1); 6.0(2)A8(9); 6.0(2)A8(1); 6.0(2)A8(10a); 7.0(3)I5(1); 9.3(1z); 9.2(2); 7.0(3)F3(4); 7.0(3)I4(8b); 8.1(2a); 7.3(2)D1(3); 6.0(2)A8(3); 7.0(3)I4(6t); 7.0(3)I5(3a); 8.1(1a); 6.0(2)A8(8); 7.0(3)I7(5); 7.0(3)F3(3a); 6.0(2)A8(4); 7.0(3)I4(8a); 7.0(3)F3(2); 7.0(3)I4(4); 7.0(3)I7(1); 7.0(3)IA7(2); 7.0(3)IA7(1); 6.0(2)A8(7b); 6.0(2)A8(4a); 8.4(1a); 9.3(3); 7.3(2)D1(1d); 7.0(3)I7(8); 9.3(4); 7.3(6)D1(1); 8.2(6); 9.3(5); 8.4(2a); 8.4(2b); 7.0(3)I7(9); 8.5(1); 9.3(6); 10.1(2); 10.1(1); 8.4(4); 7.3(7)D1(1); 8.4(2c); 9.3(5w); 8.2(7); 9.3(7); 9.3(7k); 7.0(3)I7(9w); 10.2(1); 7.3(8)D1(1); 9.3(7a); 8.2(7a); 9.3(8); 8.4(4a); 8.4(2d); 8.4(5); 7.0(3)I7(10); 8.2(8); 10.2(1q); 10.2(2); 9.3(9); 10.1(2t); 7.3(9)D1(1); 10.2(3); 8.4(6); 10.2(3t); 8.4(2e); 9.3(10); 10.2(2a); 9.2(1a); 8.2(9); 10.3(1); 10.2(4); 8.4(7); 10.3(2); 8.4(6a); 9.3(11); 10.3(3); 10.2(5); 9.4(1); 9.3(2a); 8.4(2f); 8.2(10); 9.3(12); 10.2(3v); 10.4(1); 8.4(8); 10.3(99w); 10.2(6); 10.3(3w); 10.3(99x); 10.3(3o); 8.4(9); 10.3(4); 10.3(3p); 10.3(4a); 9.4(1a); 10.4(2); 10.3(3q); 9.3(13); 8.2(11); 10.3(5); 10.2(7); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.2(8); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.4(4g)	—	No fix listed	CNA
Cisco	Cisco NX-OS System Software in ACI Mode	14.1(1j); 14.0(3d); 14.1(1k); 13.2(1m); 14.0(3c); 13.2(2l); 13.2(7k); 14.1(1l); 14.2(2f); 13.2(3s); 13.2(2o); 14.0(2c); 14.1(2m); 13.2(5e); 14.1(2o); 13.2(7f); 13.2(41d); 13.2(4d); 13.2(3o); 13.2(1l); 14.0(1h); 13.2(3n); 14.2(1l); 14.2(2e); 13.2(4e); 14.2(1i); 13.2(9b); 14.1(2s); 14.1(1i); 14.1(2g); 13.2(3j); 13.2(5d); 13.2(6i); 14.1(2u); 13.2(3i); 13.2(3r); 13.2(5f); 14.2(1j); 14.1(2w); 14.2(3n); 14.2(3l); 14.2(3j); 14.2(2g); 13.2(8d); 14.1(2x); 13.2(9f); 14.2(3q); 14.2(4i); 13.2(9h); 15.0(1k); 14.2(4k); 15.0(1l); 15.0(2e); 14.2(4o); 14.2(4p); 15.0(2h); 14.2(5k); 14.2(5l); 14.2(5n); 15.1(1h); 14.2(6d); 15.1(2e); 14.2(6g); 14.2(6h); 15.1(3e); 13.2(10e); 14.2(6l); 14.2(7f); 15.1(4c); 14.2(6o); 15.2(1g); 15.2(2e); 14.2(7l); 13.2(10f); 15.2(2f); 15.2(2g); 14.2(7q); 15.2(2h); 15.2(3f); 15.2(3e); 15.2(3g); 14.2(7r); 14.2(7s); 15.2(4d); 15.2(4e); 14.2(7t); 15.2(5c); 15.2(5d); 13.2(10g); 16.0(1g); 14.2(7u); 15.2(5e); 15.2(4f); 15.2(6e); 15.2(6h); 16.0(1j); 15.2(6g); 15.2(7f); 14.2(7v); 15.2(7g); 16.0(2h); 14.2(7w); 15.2(8d); 16.0(2j); 15.2(8e); 16.0(3d); 16.0(3e); 15.2(8f); 15.2(8g); 15.3(1d); 15.2(8h); 16.0(4c); 15.3(2a); 15.2(8i); 16.0(5h); 15.3(2b); 16.0(3g); 16.0(5j); 15.3(2c); 16.0(6c); 15.3(2d); 16.1(1f); 16.0(7e); 16.0(8e); 15.3(2e)	—	No fix listed	CNA
Cisco	Cisco Unified Computing System (Managed)	4.0(4c); 4.0(2b); 4.1(2a); 4.0(1a); 4.0(2a); 4.0(1b); 4.1(1c); 4.0(4a); 4.0(4b); 4.0(2e); 4.1(1a); 4.0(4d); 4.0(4h); 4.0(4g); 4.0(1d); 4.1(1e); 4.0(4f); 4.0(4e); 4.0(4i); 4.1(1d); 4.0(2d); 4.1(1b); 4.0(1c); 4.1(2b); 4.0(4k); 4.1(3a); 4.1(3b); 4.1(2c); 4.0(4l); 4.1(4a); 4.1(3c); 4.1(3d); 4.2(1c); 4.2(1d); 4.0(4m); 4.1(3e); 4.2(1f); 4.1(3f); 4.2(1i); 4.1(3h); 4.2(1k); 4.2(1l); 4.0(4n); 4.2(1m); 4.1(3i); 4.2(2a); 4.2(1n); 4.1(3j); 4.2(2c); 4.2(2d); 4.2(3b); 4.1(3k); 4.0(4o); 4.2(2e); 4.2(3d); 4.2(3e); 4.2(3g); 4.1(3l); 4.3(2b); 4.2(3h); 4.2(3i); 4.3(2c); 4.1(3m); 4.3(2e); 4.3(3a); 4.2(3j); 4.3(3c); 4.2(3k); 4.2(3l); 4.3(2f); 4.2(3m)	—	No fix listed	CNA

Cisco NX-OS Software VendorCisco Affected 8.2(5); 7.3(5)D1(1); 8.4(2); 8.4(3); 9.2(3); 7.0(3)I5(2); 8.2(1); 6.0(2)A8(7a); 7.0(3)I4(5); 7.3(1)D1(1); 7.0(3)I4(6); 7.0(3)I4(3); 9.2(2v); 7.3(0)D1(1); 7.0(3)I4(7); 7.0(3)I4(1); 7.0(3)I4(8); 7.0(3)I4(2); 6.0(2)A8(11); 7.3(4)D1(1); 9.2(1); 9.2(2t); 9.2(3y); 7.0(3)I4(1t); 7.0(3)I7(6z); 9.3(2); 7.3(1)DY(1); 7.0(3)F3(3); 7.0(3)I7(3z); 7.0(3)IM7(2); 6.0(2)A8(11b); 7.0(3)I7(5a); 8.1(1); 7.0(3)I6(1); 8.2(2); 7.0(3)I5(3b); 8.3(2); 7.3(2)D1(3a); 9.2(4); 6.0(2)A8(10); 6.0(2)A8(2); 7.0(3)IC4(4); 8.1(2); 7.0(3)F3(3c); 7.3(3)D1(1); 7.0(3)F3(1); 7.0(3)F3(5); 8.2(3); 7.0(3)I7(2); 7.0(3)I5(3); 7.0(3)I7(3); 6.0(2)A8(6); 7.0(3)I6(2); 8.3(1); 8.4(1); 8.1(1b); 6.0(2)A8(5); 7.3(0)DX(1); 7.3(2)D1(1); 9.3(1); 6.0(2)A8(7); 7.0(3)I7(6); 7.3(2)D1(2); 6.0(2)A8(11a); 7.0(3)I4(8z); 7.0(3)I4(9); 8.2(4); 7.0(3)I7(4); 7.0(3)I7(7); 7.3(0)DY(1); 6.0(2)A8(9); 6.0(2)A8(1); 6.0(2)A8(10a); 7.0(3)I5(1); 9.3(1z); 9.2(2); 7.0(3)F3(4); 7.0(3)I4(8b); 8.1(2a); 7.3(2)D1(3); 6.0(2)A8(3); 7.0(3)I4(6t); 7.0(3)I5(3a); 8.1(1a); 6.0(2)A8(8); 7.0(3)I7(5); 7.0(3)F3(3a); 6.0(2)A8(4); 7.0(3)I4(8a); 7.0(3)F3(2); 7.0(3)I4(4); 7.0(3)I7(1); 7.0(3)IA7(2); 7.0(3)IA7(1); 6.0(2)A8(7b); 6.0(2)A8(4a); 8.4(1a); 9.3(3); 7.3(2)D1(1d); 7.0(3)I7(8); 9.3(4); 7.3(6)D1(1); 8.2(6); 9.3(5); 8.4(2a); 8.4(2b); 7.0(3)I7(9); 8.5(1); 9.3(6); 10.1(2); 10.1(1); 8.4(4); 7.3(7)D1(1); 8.4(2c); 9.3(5w); 8.2(7); 9.3(7); 9.3(7k); 7.0(3)I7(9w); 10.2(1); 7.3(8)D1(1); 9.3(7a); 8.2(7a); 9.3(8); 8.4(4a); 8.4(2d); 8.4(5); 7.0(3)I7(10); 8.2(8); 10.2(1q); 10.2(2); 9.3(9); 10.1(2t); 7.3(9)D1(1); 10.2(3); 8.4(6); 10.2(3t); 8.4(2e); 9.3(10); 10.2(2a); 9.2(1a); 8.2(9); 10.3(1); 10.2(4); 8.4(7); 10.3(2); 8.4(6a); 9.3(11); 10.3(3); 10.2(5); 9.4(1); 9.3(2a); 8.4(2f); 8.2(10); 9.3(12); 10.2(3v); 10.4(1); 8.4(8); 10.3(99w); 10.2(6); 10.3(3w); 10.3(99x); 10.3(3o); 8.4(9); 10.3(4); 10.3(3p); 10.3(4a); 9.4(1a); 10.4(2); 10.3(3q); 9.3(13); 8.2(11); 10.3(5); 10.2(7); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.2(8); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.4(4g) Fixed in — No fix listed CNA
Cisco NX-OS System Software in ACI Mode VendorCisco Affected 14.1(1j); 14.0(3d); 14.1(1k); 13.2(1m); 14.0(3c); 13.2(2l); 13.2(7k); 14.1(1l); 14.2(2f); 13.2(3s); 13.2(2o); 14.0(2c); 14.1(2m); 13.2(5e); 14.1(2o); 13.2(7f); 13.2(41d); 13.2(4d); 13.2(3o); 13.2(1l); 14.0(1h); 13.2(3n); 14.2(1l); 14.2(2e); 13.2(4e); 14.2(1i); 13.2(9b); 14.1(2s); 14.1(1i); 14.1(2g); 13.2(3j); 13.2(5d); 13.2(6i); 14.1(2u); 13.2(3i); 13.2(3r); 13.2(5f); 14.2(1j); 14.1(2w); 14.2(3n); 14.2(3l); 14.2(3j); 14.2(2g); 13.2(8d); 14.1(2x); 13.2(9f); 14.2(3q); 14.2(4i); 13.2(9h); 15.0(1k); 14.2(4k); 15.0(1l); 15.0(2e); 14.2(4o); 14.2(4p); 15.0(2h); 14.2(5k); 14.2(5l); 14.2(5n); 15.1(1h); 14.2(6d); 15.1(2e); 14.2(6g); 14.2(6h); 15.1(3e); 13.2(10e); 14.2(6l); 14.2(7f); 15.1(4c); 14.2(6o); 15.2(1g); 15.2(2e); 14.2(7l); 13.2(10f); 15.2(2f); 15.2(2g); 14.2(7q); 15.2(2h); 15.2(3f); 15.2(3e); 15.2(3g); 14.2(7r); 14.2(7s); 15.2(4d); 15.2(4e); 14.2(7t); 15.2(5c); 15.2(5d); 13.2(10g); 16.0(1g); 14.2(7u); 15.2(5e); 15.2(4f); 15.2(6e); 15.2(6h); 16.0(1j); 15.2(6g); 15.2(7f); 14.2(7v); 15.2(7g); 16.0(2h); 14.2(7w); 15.2(8d); 16.0(2j); 15.2(8e); 16.0(3d); 16.0(3e); 15.2(8f); 15.2(8g); 15.3(1d); 15.2(8h); 16.0(4c); 15.3(2a); 15.2(8i); 16.0(5h); 15.3(2b); 16.0(3g); 16.0(5j); 15.3(2c); 16.0(6c); 15.3(2d); 16.1(1f); 16.0(7e); 16.0(8e); 15.3(2e) Fixed in — No fix listed CNA
Cisco Unified Computing System (Managed) VendorCisco Affected 4.0(4c); 4.0(2b); 4.1(2a); 4.0(1a); 4.0(2a); 4.0(1b); 4.1(1c); 4.0(4a); 4.0(4b); 4.0(2e); 4.1(1a); 4.0(4d); 4.0(4h); 4.0(4g); 4.0(1d); 4.1(1e); 4.0(4f); 4.0(4e); 4.0(4i); 4.1(1d); 4.0(2d); 4.1(1b); 4.0(1c); 4.1(2b); 4.0(4k); 4.1(3a); 4.1(3b); 4.1(2c); 4.0(4l); 4.1(4a); 4.1(3c); 4.1(3d); 4.2(1c); 4.2(1d); 4.0(4m); 4.1(3e); 4.2(1f); 4.1(3f); 4.2(1i); 4.1(3h); 4.2(1k); 4.2(1l); 4.0(4n); 4.2(1m); 4.1(3i); 4.2(2a); 4.2(1n); 4.1(3j); 4.2(2c); 4.2(2d); 4.2(3b); 4.1(3k); 4.0(4o); 4.2(2e); 4.2(3d); 4.2(3e); 4.2(3g); 4.1(3l); 4.3(2b); 4.2(3h); 4.2(3i); 4.3(2c); 4.1(3m); 4.3(2e); 4.3(3a); 4.2(3j); 4.3(3c); 4.2(3k); 4.2(3l); 4.3(2f); 4.2(3m) Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:nx-os::::::::	—	—	Cisco

cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions — — ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-20397
2026-10-03 Alias added: GHSA-p5rq-7r6m-x7rf

References

Other 1

cisco-sa-nxos-image-sig-bypas-pQDRQvjL

TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0

See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences