Cisco NSO JSON-RPC API Improper Auth Allow Remote Config Mod
CVE-2024-20381 Published on September 11, 2024

Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability
A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.  This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

NVD

Vulnerability Analysis

CVE-2024-20381 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CVE-2024-20381 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2024-20381

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20381 are published in these products:

Cisco Ios Xr
 
Cisco Network Services Orchestrator
 
Cisco Small Business Rv Series Router Firmware
 

Affected Versions

Cisco IOS XR Software: Cisco Network Services Orchestrator: Cisco Small Business RV Series Router Firmware: cisco network_services_orchestrator: cisco small_business_rv_series_router_firmware: cisco ios_xr:

Exploit Probability

EPSS
1.70%
Percentile
82.01%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.