CVE-2024-20381

Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability

Published Sep 11, 2024 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device. 

This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco IOS XR Software

unknown

Version	Status	Constraints
`6.5.3`	affected	—
`6.5.29`	affected	—
`6.5.1`	affected	—
`6.6.1`	affected	—
`6.5.2`	affected	—
`6.5.92`	affected	—
`6.5.15`	affected	—
`6.6.2`	affected	—
`7.0.1`	affected	—
`6.6.25`	affected	—
`6.5.26`	affected	—
`6.6.11`	affected	—
`6.5.25`	affected	—
`6.5.28`	affected	—
`6.5.93`	affected	—
`6.6.12`	affected	—
`6.5.90`	affected	—
`7.0.0`	affected	—
`7.1.1`	affected	—
`7.0.90`	affected	—
`6.6.3`	affected	—
`6.7.1`	affected	—
`7.0.2`	affected	—
`7.1.15`	affected	—
`7.2.0`	affected	—
`7.2.1`	affected	—
`7.1.2`	affected	—
`6.7.2`	affected	—
`7.0.11`	affected	—
`7.0.12`	affected	—
`7.0.14`	affected	—
`7.1.25`	affected	—
`6.6.4`	affected	—
`7.2.12`	affected	—
`7.3.1`	affected	—
`7.1.3`	affected	—
`6.7.3`	affected	—
`7.4.1`	affected	—
`7.2.2`	affected	—
`6.7.4`	affected	—
`6.5.31`	affected	—
`7.3.15`	affected	—
`7.3.16`	affected	—
`6.8.1`	affected	—
`7.4.15`	affected	—
`6.5.32`	affected	—
`7.3.2`	affected	—
`7.5.1`	affected	—
`7.4.16`	affected	—
`7.3.27`	affected	—
`7.6.1`	affected	—
`7.5.2`	affected	—
`7.8.1`	affected	—
`7.6.15`	affected	—
`7.5.12`	affected	—
`7.8.12`	affected	—
`7.3.3`	affected	—
`7.7.1`	affected	—
`6.8.2`	affected	—
`7.3.4`	affected	—
`7.4.2`	affected	—
`6.7.35`	affected	—
`6.9.1`	affected	—
`7.6.2`	affected	—
`7.5.3`	affected	—
`7.7.2`	affected	—
`6.9.2`	affected	—
`7.9.1`	affected	—
`7.10.1`	affected	—
`7.8.2`	affected	—
`7.5.4`	affected	—
`6.5.33`	affected	—
`7.8.22`	affected	—
`7.7.21`	affected	—
`7.9.2`	affected	—
`7.3.5`	affected	—
`7.5.5`	affected	—
`7.11.1`	affected	—
`7.9.21`	affected	—
`7.10.2`	affected	—
`24.1.1`	affected	—
`7.6.3`	affected	—
`7.3.6`	affected	—
`7.5.52`	affected	—
`7.11.2`	affected	—
`24.2.1`	affected	—
`24.1.2`	affected	—
`24.2.11`	affected	—

Cisco

Cisco Network Services Orchestrator

unknown

Version	Status	Constraints
`5.4.1`	affected	—
`5.3.1`	affected	—
`4.4.1`	affected	—
`5.2.1.1`	affected	—
`5.4.0.1`	affected	—
`4.7.1`	affected	—
`5.2.0.3`	affected	—
`5.2.1`	affected	—
`5.1.2`	affected	—
`5.4`	affected	—
`4.5.1`	affected	—
`5.4.0.2`	affected	—
`4.7.3`	affected	—
`5.2.0.4`	affected	—
`5.1.1.1`	affected	—
`5.1.1.3`	affected	—
`5.2.3.2`	affected	—
`5.4.1.1`	affected	—
`5.5`	affected	—
`5.4.2`	affected	—
`5.5.1`	affected	—
`5.4.3`	affected	—
`5.4.3.1`	affected	—
`5.5.2`	affected	—
`5.3.4.3`	affected	—
`5.5.2.1`	affected	—
`5.5.2.2`	affected	—
`5.4.3.2`	affected	—
`5.5.2.3`	affected	—
`5.4.4`	affected	—
`5.4.4.1`	affected	—
`5.5.2.4`	affected	—
`5.5.2.5`	affected	—
`5.5.2.6`	affected	—
`5.4.4.2`	affected	—
`5.4.3.3`	affected	—
`5.5.2.7`	affected	—
`5.5.2.8`	affected	—
`5.4.3.4`	affected	—
`5.4.4.3`	affected	—
`5.6`	affected	—
`5.5.2.9`	affected	—
`5.5.3`	affected	—
`5.5.2.10`	affected	—
`5.6.1`	affected	—
`5.5.2.11`	affected	—
`5.6.2`	affected	—
`5.5.3.1`	affected	—
`5.4.5`	affected	—
`5.4.5.1`	affected	—
`5.5.4`	affected	—
`5.6.3`	affected	—
`5.5.4.1`	affected	—
`5.7`	affected	—
`5.5.2.12`	affected	—
`5.4.2.1`	affected	—
`5.6.3.1`	affected	—
`5.4.5.2`	affected	—
`5.7.1`	affected	—
`5.7.1.1`	affected	—
`5.6.4`	affected	—
`5.4.2.2`	affected	—
`5.4.6`	affected	—
`5.7.2`	affected	—
`5.7.2.1`	affected	—
`5.6.5`	affected	—
`5.5.5`	affected	—
`5.7.3`	affected	—
`5.8`	affected	—
`5.6.6.1`	affected	—
`5.7.5.1`	affected	—
`5.6.7.1`	affected	—
`5.6.7`	affected	—
`5.5.6.1`	affected	—
`5.8.1`	affected	—
`5.6.6`	affected	—
`5.4.7`	affected	—
`5.8.2.1`	affected	—
`5.7.5`	affected	—
`5.7.4`	affected	—
`5.8.2`	affected	—
`5.5.6`	affected	—
`5.6.7.2`	affected	—
`5.7.6`	affected	—
`5.7.6.1`	affected	—
`5.8.3`	affected	—
`5.6.8`	affected	—
`5.7.6.2`	affected	—
`5.8.4`	affected	—
`5.5.7`	affected	—
`5.7.7`	affected	—
`5.6.9`	affected	—
`5.6.8.1`	affected	—
`5.8.5`	affected	—
`5.5.8`	affected	—
`5.7.8`	affected	—
`5.4.7.1`	affected	—
`6.0`	affected	—
`5.7.8.1`	affected	—
`6.0.1`	affected	—
`5.6.10`	affected	—
`5.8.6`	affected	—
`6.0.1.1`	affected	—
`6.0.2`	affected	—
`5.7.9`	affected	—
`5.5.9`	affected	—
`5.6.11`	affected	—
`5.8.7`	affected	—
`6.0.3`	affected	—
`5.7.10`	affected	—
`5.6.12`	affected	—
`5.8.8`	affected	—
`6.0.4`	affected	—
`5.5.10`	affected	—
`5.7.10.1`	affected	—
`6.1`	affected	—
`5.7.6.3`	affected	—
`5.7.11`	affected	—
`6.0.5`	affected	—
`5.6.13`	affected	—
`5.8.9`	affected	—
`6.1.1`	affected	—
`5.7.10.2`	affected	—
`6.0.6`	affected	—
`5.7.12`	affected	—
`6.1.2`	affected	—
`5.6.14`	affected	—
`6.1.2.1`	affected	—
`5.8.10`	affected	—
`6.0.7`	affected	—
`6.1.3`	affected	—
`5.7.13`	affected	—
`5.8.11`	affected	—
`6.1.3.1`	affected	—
`6.0.8`	affected	—
`6.1.4`	affected	—
`5.6.14.1`	affected	—
`5.8.12`	affected	—
`6.0.9`	affected	—
`6.1.5`	affected	—
`6.2`	affected	—
`5.8.13`	affected	—
`5.7.14`	affected	—
`6.0.10`	affected	—
`6.1.6`	affected	—
`6.1.6.1`	affected	—
`6.0.11`	affected	—
`6.1.7`	affected	—
`6.2.2`	affected	—
`5.7.15`	affected	—
`6.1.3.2`	affected	—
`6.1.7.1`	affected	—
`6.0.12`	affected	—
`6.1.8`	affected	—
`5.7.9.1`	affected	—
`5.7.15.1`	affected	—
`6.1.10`	affected	—
`6.1.11`	affected	—
`5.1.4.3`	affected	—
`6.1.11.1`	affected	—
`6.1.11.2`	affected	—
`5.7.17`	affected	—
`6.1.12`	affected	—

Cisco

Cisco Small Business RV Series Router Firmware

unknown

Version	Status	Constraints
`1.0.01.17`	affected	—
`1.0.03.17`	affected	—
`1.0.01.16`	affected	—
`1.0.01.18`	affected	—
`1.0.00.29`	affected	—
`1.0.03.16`	affected	—
`1.0.03.15`	affected	—
`1.0.02.16`	affected	—
`1.0.01.20`	affected	—
`1.0.00.33`	affected	—
`1.0.03.18`	affected	—
`1.0.03.19`	affected	—
`1.0.03.20`	affected	—
`1.0.03.21`	affected	—
`1.0.03.22`	affected	—
`1.0.03.24`	affected	—
`1.0.03.26`	affected	—
`1.0.03.27`	affected	—
`1.0.03.28`	affected	—
`1.0.03.29`	affected	—

Configuration 1 [-]

OR	cpe:2.3:o:cisco:ios_xr:6.5.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.15:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.25:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.26:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.28:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.29:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.31:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.32:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.33:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.90:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.92:::::::*
	cpe:2.3:o:cisco:ios_xr:6.5.93:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.11:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.12:::::::*
	cpe:2.3:o:cisco:ios_xr:6.6.25:::::::*
	cpe:2.3:o:cisco:ios_xr:6.7.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.7.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.7.3:::::::*
	cpe:2.3:o:cisco:ios_xr:6.7.4:::::::*
	cpe:2.3:o:cisco:ios_xr:6.7.35:::::::*
	cpe:2.3:o:cisco:ios_xr:6.8.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.8.2:::::::*
	cpe:2.3:o:cisco:ios_xr:6.9.1:::::::*
	cpe:2.3:o:cisco:ios_xr:6.9.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.0:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.11:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.12:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.14:::::::*
	cpe:2.3:o:cisco:ios_xr:7.0.90:::::::*
	cpe:2.3:o:cisco:ios_xr:7.1.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.1.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.1.3:::::::*
	cpe:2.3:o:cisco:ios_xr:7.1.15:::::::*
	cpe:2.3:o:cisco:ios_xr:7.1.25:::::::*
	cpe:2.3:o:cisco:ios_xr:7.2.0:::::::*
	cpe:2.3:o:cisco:ios_xr:7.2.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.2.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.2.12:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.3:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.4:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.5:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.6:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.15:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.16:::::::*
	cpe:2.3:o:cisco:ios_xr:7.3.27:::::::*
	cpe:2.3:o:cisco:ios_xr:7.4.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.4.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.4.15:::::::*
	cpe:2.3:o:cisco:ios_xr:7.4.16:::::::*
	cpe:2.3:o:cisco:ios_xr:7.5.1:::::::*
	cpe:2.3:o:cisco:ios_xr:7.5.2:::::::*
	cpe:2.3:o:cisco:ios_xr:7.5.3:::::::*
	cpe:2.3:o:cisco:ios_xr:7.5.4:::::::*
	cpe:2.3:o:cisco:ios_xr:7.5.5:::::::*
cpe:2.3:o:cisco:ios_xr:7.5.12:::::::*
cpe:2.3:o:cisco:ios_xr:7.5.52:::::::*
cpe:2.3:o:cisco:ios_xr:7.6.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.6.2:::::::*
cpe:2.3:o:cisco:ios_xr:7.6.3:::::::*
cpe:2.3:o:cisco:ios_xr:7.6.15:::::::*
cpe:2.3:o:cisco:ios_xr:7.7.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.7.2:::::::*
cpe:2.3:o:cisco:ios_xr:7.7.21:::::::*
cpe:2.3:o:cisco:ios_xr:7.8.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.8.2:::::::*
cpe:2.3:o:cisco:ios_xr:7.8.12:::::::*
cpe:2.3:o:cisco:ios_xr:7.8.22:::::::*
cpe:2.3:o:cisco:ios_xr:7.9.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.9.2:::::::*
cpe:2.3:o:cisco:ios_xr:7.9.21:::::::*
cpe:2.3:o:cisco:ios_xr:7.10.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.10.2:::::::*
cpe:2.3:o:cisco:ios_xr:7.11.1:::::::*
cpe:2.3:o:cisco:ios_xr:7.11.2:::::::*
cpe:2.3:o:cisco:ios_xr:24.1.1:::::::*
cpe:2.3:o:cisco:ios_xr:24.1.2:::::::*
cpe:2.3:o:cisco:ios_xr:24.2.1:::::::*
cpe:2.3:o:cisco:ios_xr:24.2.11:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:cisco:network_services_orchestrator:4.4.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:4.5.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:4.7.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:4.7.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.1.1.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.1.1.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.1.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.1.4.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.2.0.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.2.0.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.2.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.2.1.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.2.3.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.3.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.3.4.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.0.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.0.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.1.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.2.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.2.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.5:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.5.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.5.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.6:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.7:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.4.7.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.2:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.5:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.6:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.7:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.8:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.9:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.10:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.11:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.12:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.3:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.3.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.4:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.4.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.5:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.6:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.6.1:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.7:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.8:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.9:::::::*
	cpe:2.3:a:cisco:network_services_orchestrator:5.5.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.3.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.4:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.5:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.6.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.7.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.7.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.8.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.9:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.11:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.12:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.13:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.14:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.6.14.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.1.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.2.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.4:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.5:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.5.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.8.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.9:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.9.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.10.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.10.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.11:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.12:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.13:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.14:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.15:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.15.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.7.17:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.2.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.4:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.5:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.9:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.11:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.12:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:5.8.13:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.1.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.4:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.5:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.9:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.11:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.0.12:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.2.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.3:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.3.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.3.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.4:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.5:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.6:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.6.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.7:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.7.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.8:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.10:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.11:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.11.1:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.11.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.1.12:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.2:::::::*
cpe:2.3:a:cisco:network_services_orchestrator:6.2.2:::::::*

Configuration 3 [-]

OR	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.00.29:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.00.33:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.16:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.17:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.18:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.20:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.02.16:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.15:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.16:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.17:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.18:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.19:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.20:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.21:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.22:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.24:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.26:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.27:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.28:::::::*
	cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.29:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-18096	A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.  This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.576% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp

History

Oct 8, 2024 10:00 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:cisco:network_services_orchestrator:4.4.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:4.5.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:4.7.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:4.7.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.1.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.1.1.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.1.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.1.4.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.2.0.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.2.0.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.2.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.2.3.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.3.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.3.4.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.0.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.0.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.2.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.3.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.4.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.5.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.5.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.7.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.3.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.4.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.13:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.14.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.14:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.3.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.7.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.7.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.8.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.10.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.10.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.13:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.14:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.15.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.15:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.17:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.5.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.6.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.8.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.9.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.13:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:5.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0.9:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.0:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.10:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.11.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.11.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.11:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.12:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.2.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.3.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.3.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.3:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.4:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.5:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.6:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.7.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.7:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1.8:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.1:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.2.2:::::::* cpe:2.3:a:cisco:network_services_orchestrator:6.2:::::::* cpe:2.3:o:cisco:ios_xr:24.1.1:::::::* cpe:2.3:o:cisco:ios_xr:24.1.2:::::::* cpe:2.3:o:cisco:ios_xr:24.2.11:::::::* cpe:2.3:o:cisco:ios_xr:24.2.1:::::::* cpe:2.3:o:cisco:ios_xr:6.5.15:::::::* cpe:2.3:o:cisco:ios_xr:6.5.1:::::::* cpe:2.3:o:cisco:ios_xr:6.5.25:::::::* cpe:2.3:o:cisco:ios_xr:6.5.26:::::::* cpe:2.3:o:cisco:ios_xr:6.5.28:::::::* cpe:2.3:o:cisco:ios_xr:6.5.29:::::::* cpe:2.3:o:cisco:ios_xr:6.5.2:::::::* cpe:2.3:o:cisco:ios_xr:6.5.31:::::::* cpe:2.3:o:cisco:ios_xr:6.5.32:::::::* cpe:2.3:o:cisco:ios_xr:6.5.33:::::::* cpe:2.3:o:cisco:ios_xr:6.5.3:::::::* cpe:2.3:o:cisco:ios_xr:6.5.90:::::::* cpe:2.3:o:cisco:ios_xr:6.5.92:::::::* cpe:2.3:o:cisco:ios_xr:6.5.93:::::::* cpe:2.3:o:cisco:ios_xr:6.6.11:::::::* cpe:2.3:o:cisco:ios_xr:6.6.12:::::::* cpe:2.3:o:cisco:ios_xr:6.6.1:::::::* cpe:2.3:o:cisco:ios_xr:6.6.25:::::::* cpe:2.3:o:cisco:ios_xr:6.6.2:::::::* cpe:2.3:o:cisco:ios_xr:6.6.3:::::::* cpe:2.3:o:cisco:ios_xr:6.6.4:::::::* cpe:2.3:o:cisco:ios_xr:6.7.1:::::::* cpe:2.3:o:cisco:ios_xr:6.7.2:::::::* cpe:2.3:o:cisco:ios_xr:6.7.35:::::::* cpe:2.3:o:cisco:ios_xr:6.7.3:::::::* cpe:2.3:o:cisco:ios_xr:6.7.4:::::::* cpe:2.3:o:cisco:ios_xr:6.8.1:::::::* cpe:2.3:o:cisco:ios_xr:6.8.2:::::::* cpe:2.3:o:cisco:ios_xr:6.9.1:::::::* cpe:2.3:o:cisco:ios_xr:6.9.2:::::::* cpe:2.3:o:cisco:ios_xr:7.0.0:::::::* cpe:2.3:o:cisco:ios_xr:7.0.11:::::::* cpe:2.3:o:cisco:ios_xr:7.0.12:::::::* cpe:2.3:o:cisco:ios_xr:7.0.14:::::::* cpe:2.3:o:cisco:ios_xr:7.0.1:::::::* cpe:2.3:o:cisco:ios_xr:7.0.2:::::::* cpe:2.3:o:cisco:ios_xr:7.0.90:::::::* cpe:2.3:o:cisco:ios_xr:7.1.15:::::::* cpe:2.3:o:cisco:ios_xr:7.1.1:::::::* cpe:2.3:o:cisco:ios_xr:7.1.25:::::::* cpe:2.3:o:cisco:ios_xr:7.1.2:::::::* cpe:2.3:o:cisco:ios_xr:7.1.3:::::::* cpe:2.3:o:cisco:ios_xr:7.10.1:::::::* cpe:2.3:o:cisco:ios_xr:7.10.2:::::::* cpe:2.3:o:cisco:ios_xr:7.11.1:::::::* cpe:2.3:o:cisco:ios_xr:7.11.2:::::::* cpe:2.3:o:cisco:ios_xr:7.2.0:::::::* cpe:2.3:o:cisco:ios_xr:7.2.12:::::::* cpe:2.3:o:cisco:ios_xr:7.2.1:::::::* cpe:2.3:o:cisco:ios_xr:7.2.2:::::::* cpe:2.3:o:cisco:ios_xr:7.3.15:::::::* cpe:2.3:o:cisco:ios_xr:7.3.16:::::::* cpe:2.3:o:cisco:ios_xr:7.3.1:::::::* cpe:2.3:o:cisco:ios_xr:7.3.27:::::::* cpe:2.3:o:cisco:ios_xr:7.3.2:::::::* cpe:2.3:o:cisco:ios_xr:7.3.3:::::::* cpe:2.3:o:cisco:ios_xr:7.3.4:::::::* cpe:2.3:o:cisco:ios_xr:7.3.5:::::::* cpe:2.3:o:cisco:ios_xr:7.3.6:::::::* cpe:2.3:o:cisco:ios_xr:7.4.15:::::::* cpe:2.3:o:cisco:ios_xr:7.4.16:::::::* cpe:2.3:o:cisco:ios_xr:7.4.1:::::::* cpe:2.3:o:cisco:ios_xr:7.4.2:::::::* cpe:2.3:o:cisco:ios_xr:7.5.12:::::::* cpe:2.3:o:cisco:ios_xr:7.5.1:::::::* cpe:2.3:o:cisco:ios_xr:7.5.2:::::::* cpe:2.3:o:cisco:ios_xr:7.5.3:::::::* cpe:2.3:o:cisco:ios_xr:7.5.4:::::::* cpe:2.3:o:cisco:ios_xr:7.5.52:::::::* cpe:2.3:o:cisco:ios_xr:7.5.5:::::::* cpe:2.3:o:cisco:ios_xr:7.6.15:::::::* cpe:2.3:o:cisco:ios_xr:7.6.1:::::::* cpe:2.3:o:cisco:ios_xr:7.6.2:::::::* cpe:2.3:o:cisco:ios_xr:7.6.3:::::::* cpe:2.3:o:cisco:ios_xr:7.7.1:::::::* cpe:2.3:o:cisco:ios_xr:7.7.21:::::::* cpe:2.3:o:cisco:ios_xr:7.7.2:::::::* cpe:2.3:o:cisco:ios_xr:7.8.12:::::::* cpe:2.3:o:cisco:ios_xr:7.8.1:::::::* cpe:2.3:o:cisco:ios_xr:7.8.22:::::::* cpe:2.3:o:cisco:ios_xr:7.8.2:::::::* cpe:2.3:o:cisco:ios_xr:7.9.1:::::::* cpe:2.3:o:cisco:ios_xr:7.9.21:::::::* cpe:2.3:o:cisco:ios_xr:7.9.2:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.00.29:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.00.33:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.16:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.17:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.18:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.01.20:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.02.16:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.15:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.16:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.17:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.18:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.19:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.20:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.21:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.22:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.24:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.26:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.27:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.28:::::::* cpe:2.3:o:cisco:small_business_rv_series_router_firmware:1.0.03.29:::::::*

Sep 27, 2024 2:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco ios Xr Cisco network Services Orchestrator Cisco small Business Rv Series Router Firmware
CPEs		cpe:2.3:a:cisco:network_services_orchestrator:::::::: cpe:2.3:o:cisco:ios_xr:::::::: cpe:2.3:o:cisco:small_business_rv_series_router_firmware::::::::
Vendors & Products		Cisco Cisco ios Xr Cisco network Services Orchestrator Cisco small Business Rv Series Router Firmware
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 25, 2024 4:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	A vulnerability in the JSON-RPC API feature in ConfD that is used by the web-based management interfaces of Cisco Crosswork Network Services Orchestrator (NSO), Cisco Optical Site Manager, and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device. This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.	A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.  This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

Sep 11, 2024 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in the JSON-RPC API feature in ConfD that is used by the web-based management interfaces of Cisco Crosswork Network Services Orchestrator (NSO), Cisco Optical Site Manager, and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device. This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.
Title		Cisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability
Weaknesses		CWE-285
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`