Cisco has released patches for several series of Nexus switches to fix a vulnerability that could allow attackers to hide the execution of bash commands on the underlying operating system.

Although the flaw is rated with moderate severity because it requires administrative credentials to exploit, it has been exploited in the wild since April, showing that attackers don’t target just critical or high-risk flaws.

Tracked as CVE-2024-20399, the flaw is caused by insufficient validation of arguments passed with configuration commands to the command line interface of NX-OS software that powers various series of Cisco switches: MDS 9000 Series Multilayer Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches and Nexus 9000 Series Switches in standalone NX-OS mode.