Cisco NX-OS (bootloader / image signature verification): Secure boot on the switch is defeatable: an attacker

CVSS 5.2CVE-2024-20397Firmware, BMC & network fabriccurated

Impact

Secure boot on the switch is defeatable: an attacker with physical access or admin credentials can make a Nexus load an unsigned NX-OS image. That is how a fabric compromise becomes permanent — a modified image keeps root across reloads and reflashes, and nothing in your config management will notice. Affects Nexus 3000/7000/9000, MDS 9000 and UCS 6400/6500 fabric interconnects, so it covers both the Ethernet and the storage fabric.

Who can reach it

Physical access to the switch (console/bootloader prompt) or an existing administrative account. Realistic threat model for colocation, shared cages, and any switch that has passed through a supply chain or an RMA.

What to do

BIOS update on both the primary and the alternate BIOS bank — either through install all with a fixed NX-OS release or Cisco's release-independent BIOS upgrade script. This is a firmware flash, needs a reload, and must be applied per-device; you cannot fix it with config. Pair it with physical access control on the console ports.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-image-sig-bypas-pQDRQvjL https://nvd.nist.gov/vuln/detail/CVE-2024-20397

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.