Cisco NX-OS/NX-OS ACI Mode/Unified Computing System CLI os command injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco NX-OS, NX-OS ACI Mode and Unified Computing System. This vulnerability affects unknown code of the component CLI. The manipulation results in os command injection. This vulnerability was named CVE-2025-20292. The attack needs to be approached locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco NX-OS, NX-OS ACI Mode and Unified Computing System (affected version unknown). Affected is an unknown functionality of the component CLI. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted input as the argument of an affected CLI command. A successful exploit could allow the attacker to read and write files on the underlying operating system with the privileges of a non-root user account. File system access is limited to the permissions that are granted to that non-root user account.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2025-20292 since 10/10/2024. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/29/2025). The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• NX-OS
• NX-OS ACI Mode
• Unified Computing System

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion