CVE-2024-20285
Cisco Nx-Os 9.3\(13\)
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20285 is a medium-severity Improper Isolation or Compartmentalization (CWE-653) vulnerability in Cisco Nx-Os. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-2 (Separation of System and User Functionality) and SC-3 (Security Function Isolation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18000
Vulnerability Data
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient…
more
validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. Note: An attacker must be authenticated with Python execution privileges to exploit these vulnerabilities. For more information regarding Python execution privileges, see product-specific documentation, such as the section of the Cisco Nexus 9000 Series NX-OS Programmability Guide.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Security function isolation is the canonical mechanism for protecting higher-privilege compartments.
Process isolation maintains separate execution domains so one process cannot affect another’s privilege level.
Explicit separation of user and management functionality implements the required compartmentalization.
System partitioning creates distinct domains that enforce isolation between differently privileged components.
Access enforcement directly requires approved authorizations to be applied to compartmentalized resources.
Information flow enforcement structurally prevents unauthorized mixing of data or functions across privilege boundaries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policies establish the boundaries that isolation must enforce.
A.5.18's provisioning, review, SoD enforcement, activation-only-after-authorization, and timely revocation directly stop exploitation of improper isolation/compartmentalization by ensuring privilege boundaries are authorized, segregated, and maintained; bounded remainder is flawed isolation designs that are never granted rights in the first place (pure design flaw, not a rights-management failure).
A.5.3 directly mandates determining and enforcing segregation of conflicting duties/roles (with examples that map to privilege boundaries), which stops improper isolation from being exploitable in most cases; the bounded remainder is small organizations or cases where segregation is impracticable and the clause itself falls back to other controls.
Privileged access rights require strict isolation from ordinary user contexts.
A.8.22's network-domain segregation and perimeter gateways (firewalls) directly enforce isolation between trust/criticality levels, stopping cross-domain exploitation of improper compartmentalization for the bulk of network-based privilege flows; the bounded remainder is non-network resources (e.g. process-level or in-memory compartmentalization inside a single domain).
A.8.27 mandates security-by-design principles including least privilege, defense-in-depth, compartmentalization via zero-trust/never-trust, fail-secure, and explicit analysis of control placement and integration to isolate differing privilege levels; this stops exploitation of most improper-isolation cases but leaves a bounded remainder (e.g. certain legacy or safety-overriding exceptions that must be formally acknowledged).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-653, a class-level weakness, and none of its children carries one either.