CVE-2024-20381
📋 TL;DR
This vulnerability allows authenticated remote attackers to bypass authorization checks in the JSON-RPC API of affected Cisco products, enabling unauthorized configuration changes. Attackers could create new user accounts, elevate privileges, or modify device settings. Affected systems include Cisco Crosswork NSO, ConfD, Optical Site Manager, and RV340 VPN Routers.
💻 Affected Systems
- Cisco Crosswork Network Services Orchestrator (NSO)
- Cisco ConfD
- Cisco Optical Site Manager
- Cisco RV340 Dual WAN Gigabit VPN Router
📦 What is this software?
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Ios Xr by Cisco
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
Small Business Rv Series Router Firmware by Cisco
View all CVEs affecting Small Business Rv Series Router Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attacker gains administrative control, creates persistent backdoors, modifies network configurations to intercept traffic, and potentially disables security controls.
Likely Case
Privilege escalation leading to unauthorized configuration changes, creation of new administrative accounts, and potential disruption of network services.
If Mitigated
Limited impact if proper network segmentation, API access controls, and monitoring are in place to detect and block unauthorized API requests.
🎯 Exploit Status
Exploitation requires authenticated access but authorization bypass makes it straightforward once initial access is obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Cisco Security Advisory for specific fixed versions
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp
Restart Required: Yes
Instructions:
1. Review Cisco Security Advisory for affected versions. 2. Download and apply appropriate patches from Cisco. 3. Restart affected services or devices. 4. Verify patch application and test functionality.
🔧 Temporary Workarounds
Restrict JSON-RPC API Access
allLimit network access to JSON-RPC API endpoints using firewall rules or network segmentation
Implement API Rate Limiting
allConfigure rate limiting on JSON-RPC API endpoints to detect and block suspicious activity
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Enhance monitoring of JSON-RPC API logs for unauthorized configuration changes and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check device/application version against affected versions listed in Cisco Security AdvisoryCheck Version:
Device/application specific - consult product documentation for version check commandsVerify Fix Applied:
Verify installed version matches or exceeds fixed versions specified in Cisco advisory📡 Detection & Monitoring
Log Indicators:
- Unusual JSON-RPC API requests
- Configuration changes from unexpected users/sources
- New user account creation via API
- Privilege escalation attempts
Network Indicators:
- Unusual traffic patterns to JSON-RPC API endpoints
- Multiple configuration change requests in short timeframes
SIEM Query:
Search for JSON-RPC API requests containing configuration modification operations from non-admin users or unexpected source IPs