Description

CVE-2024-20381 is a vulnerability in the JSON-RPC API feature of ConfD, used by Cisco Crosswork Network Services Orchestrator (NSO), Cisco Optical Site Manager, and Cisco RV340 Dual WAN Gigabit VPN Routers. This vulnerability allows an authenticated, remote attacker to modify the configuration of an affected application or device due to improper authorization checks on the API.

Key Insights

• High Severity: The CVSS score of 8.8 indicates a high severity vulnerability, requiring immediate attention.
• SVRS Score: The SOCRadar Vulnerability Risk Score (SVRS) of 34 suggests a moderate risk, highlighting the need for monitoring and mitigation.
• Exploitation: Active exploits have been published, indicating that attackers are actively exploiting this vulnerability.
• CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.

Mitigation Strategies

• Apply Software Updates: Install the latest software updates from Cisco to patch the vulnerability.
• Restrict Access: Limit access to the affected API to only authorized users and devices.
• Monitor Network Traffic: Monitor network traffic for suspicious activity and block any unauthorized access attempts.
• Use a Web Application Firewall (WAF): Implement a WAF to filter and block malicious requests targeting the vulnerable API.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.